{"id":8163,"date":"2026-09-23T09:08:05","date_gmt":"2026-09-23T09:08:05","guid":{"rendered":"https:\/\/prwatech.in\/blog\/?p=8163"},"modified":"2026-09-24T15:01:54","modified_gmt":"2026-09-24T15:01:54","slug":"gcp-service-account","status":"publish","type":"post","link":"https:\/\/prwatech.in\/blog\/google-cloud-platform\/iam\/gcp-service-account\/","title":{"rendered":"GCP Service Account"},"content":{"rendered":"\r\n

Introduction to Service Accounts<\/h1>\r\n

A service account is an identity for something that is not a person, an application, a virtual machine, or a script that needs to call Google Cloud APIs on its own. Where your own Google account represents you logging in, a service account represents a piece of software acting under its own set of permissions, separate from any individual user. This walks through creating one, assigning it a role, and either disabling or deleting it when it is no longer needed.<\/p>\r\n

Step by Step Process of Creating a Service Account in GCP<\/h2>\r\n

Step One: Open Service Accounts<\/h3>\r\n

Open the console, then<\/p>\r\n\r\n\r\n\r\n

Open Menu > IAM & Admin > Service Accounts<\/p>\r\n\r\n\r\n\r\n

Click on Create Service Account.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Step Two: Name and Describe It<\/h3>\r\n

Give it a name, a service account ID will be generated automatically, and add a description if you want one. Click Create.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Step Three: Grant a Role<\/h3>\r\n

Give the service account an access role, then click Done.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Step Four: Confirm Creation<\/h3>\r\n

The service account is created.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Avoid Downloadable Service Account Keys Whenever You Can<\/h2>\r\n

A service account key is a downloadable file containing a credential that lets whoever has it authenticate as that service account, with no time limit unless you set one and no built in link to any specific machine. If that file ends up in the wrong place, a public code repository, a laptop that gets lost, an email attachment, whoever finds it has exactly the same access the service account does, for as long as the key stays valid. This is a well known, common source of real cloud security incidents.<\/p>\r\n

Google’s current recommendation is to avoid creating a key at all whenever there is another option. In most common situations there is one. A service account attached directly to a resource, such as a Compute Engine VM or a Cloud Function, can use that resource’s identity automatically without any key file existing anywhere. For workloads running outside Google Cloud entirely, Workload Identity Federation lets an external system authenticate using short lived tokens instead of a long lived key. Reach for a downloadable key only when neither of these genuinely fits your situation.<\/p>\r\n

Step Five: Select a Service Account to Remove<\/h3>\r\n

Tick the checkbox next to the service account you want to remove, then click Delete.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Step Six: Disable or Delete<\/h3>\r\n

Choose Disable or Delete.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n

Disable Versus Delete: Which to Choose<\/h2>\r\n

Disabling is reversible. The service account stops being able to authenticate immediately, but it still exists and can be re-enabled later if you decide you need it after all, which makes it the safer choice whenever you are not completely certain the account is no longer needed anywhere. Deleting is permanent. If anything you have forgotten about still depends on that identity, deleting it will break that thing immediately, and a deleted service account’s exact email address generally cannot be reused for a new one for some time afterward. When in doubt, disable first, confirm nothing breaks, and delete later once you are sure.<\/p>\r\n

Common Mistakes to Avoid<\/h2>\r\n