A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from https://developers.google.com/compute/docs/access/create-enable-service-accounts-for-instances below:

Create a VM that uses a user-managed service account | Compute Engine Documentation

Create a VM that uses a user-managed service account

Stay organized with collections Save and categorize content based on your preferences.

This document explains how to create a virtual machine (VM) instance that is configured to use a user-managed service account. A service account is a special kind of account typically used by an application or compute workload to make authorized API calls.

Service accounts are needed for scenarios where a workload, such as a custom application, needs to access Google Cloud resources or perform actions without end-user involvement. For more information about when to use service accounts, see Best practices for using service accounts.

If you have applications that need to make calls to Google Cloud APIs, Google recommends that you attach a user-managed service account to the VM on which the application or workload is running. Then, you grant the service account IAM roles, which gives the service account–and, by extension, applications running on the VM–access to Google Cloud resources.

Note: When a user connects to a VM, that user can use all of the IAM permissions granted to the service account attached to the VM. Before you begin Required roles

To get the permissions that you need to create VMs that use service accounts, ask your administrator to grant you the following IAM roles on the project:

For more information about granting roles, see Manage access to projects, folders, and organizations.

These predefined roles contain the permissions required to create VMs that use service accounts. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to create VMs that use service accounts:

You might also be able to get these permissions with custom roles or other predefined roles.

Overview

It is recommended that you configure service accounts for your VMs as follows:

  1. Create a new user-managed service account rather than using the Compute Engine default service account, and grant IAM roles to that service account for only the resources and operations that it needs.
  2. Attach the service account to your VM.
  3. Set the cloud platform (https://www.googleapis.com/auth/cloud-platform) scope on your VM. This allows the VM's service account to call the Google Cloud APIs that it has permission to use.
Set up a service account

Create a service account and assign the required IAM roles. Assign as many or as little IAM roles as needed. You can modify the IAM roles on your service account as needed.

Google recommends that you limit the privileges of service accounts and regularly check your service account permissions to make sure they are up-to-date.

Use one of the following methods to set up the service account.

Console

    In the Google Cloud console, go to the Create service account page.

    Go to Create service account
  1. Select your project.

  2. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

    In the Service account description field, enter a description. For example, Service account for quickstart.

  3. Click Create and continue.

  4. Grant the required roles to the service account.

    To grant a role, find the Select a role list, then select the role.

    To grant additional roles, click add Add another role and add each additional role.

    Note: The Role field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later. In production environments, do not grant the Owner, Editor, or Viewer roles. Instead, grant a predefined role or custom role that meets your needs.
  5. Click Continue.

  6. In the Service account users role field, enter the identifier for the principal that will attach the service account to other resources, such as Compute Engine instances.

    This is typically the email address for a Google Account.

  7. Click Done to finish creating the service account.

gcloud

    In the Google Cloud console, go to the Create service account page.

    Go to Create service account
  1. Select your project.

  2. In the Service account name field, enter a name. The Google Cloud console fills in the Service account ID field based on this name.

    In the Service account description field, enter a description. For example, Service account for quickstart.

  3. Click Create and continue.

  4. Grant the required roles to the service account.

    To grant a role, find the Select a role list, then select the role.

    To grant additional roles, click add Add another role and add each additional role.

    Note: The Role field affects which resources the service account can access in your project. You can revoke these roles or grant additional roles later. In production environments, do not grant the Owner, Editor, or Viewer roles. Instead, grant a predefined role or custom role that meets your needs.
  5. Click Continue.

  6. In the Service account users role field, enter the identifier for the principal that will attach the service account to other resources, such as Compute Engine instances.

    This is typically the email address for a Google Account.

  7. Click Done to finish creating the service account.

Terraform

To create a service account, you can use the google_service_account resource.

Remember to replace the placeholder values for the account_id and the display_name attributes.

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

Create a VM and attach the service account

After you create the service account, create a VM and attach the service account that you created in the previous section. Also set the VM's access scope to cloud-platform.

If you already have an existing VM and you want to configure that VM to use a different service account, see Change the attached service account.

Use one of the following methods to create a VM and attach the service account.

Console

  1. In the Google Cloud console, go to the Create an instance page.

    Go to Create an instance

  2. To attach a service account, do the following:

    1. In the navigation menu, click Security.
    2. In the Service account list, select the service account that you created.
    3. For Access scopes, select Allow full access to all Cloud APIs.

  3. Optional: Specify other configuration options. For more information, see Configuration options during instance creation.

  4. To create and start the instance, click Create.

gcloud

To create a new VM instance and configure it to use a custom service account by using the Google Cloud CLI, use the gcloud compute instances create command and provide the service account email and the cloud-platform access scope to the VM instance.

gcloud compute instances create VM_NAME \
    --service-account=SERVICE_ACCOUNT_EMAIL \
    --scopes=https://www.googleapis.com/auth/cloud-platform

Replace the following:

For example:

gcloud compute instances create example-vm \
    --service-account 123-my-sa@my-project-123.iam.gserviceaccount.com \
    --scopes=https://www.googleapis.com/auth/cloud-platform

You can also specify the scope using the alias: --scopes=cloud-platform. These aliases are recognized only by the gcloud CLI. The API and other libraries don't recognize these aliases, so you must specify the full scope URI.

Terraform

To set up a new VM to use a service account, you can use the google_compute_instance resource.

REST

Use the instances.insert method to create the VM and specify the service account email and access scope for the VM instance.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances

{
   "machineType":"zones/MACHINE_TYPE_ZONE/machineTypes/MACHINE_TYPE",
   "name":"VM_NAME",
   
   "disks":[
      {
         "initializeParams":{
            "sourceImage":"projects/IMAGE_PROJECT/global/images/IMAGE"
         },
         "boot":true
      }
   ],
   
   
   "networkInterfaces":[
      {
         "network":"global/networks/NETWORK_NAME"
      }
   ],
   
  "serviceAccounts": [
      {
      "email": "SERVICE_ACCOUNT_EMAIL",
      "scopes": ["https://www.googleapis.com/auth/cloud-platform"]
      }
   ],
   "shieldedInstanceConfig":{
      "enableSecureBoot":"ENABLE_SECURE_BOOT"
   }
}

Replace the following:

Access and use other Google Cloud services

After your VM is configured to use the service account, applications can then use the service account to authenticate. The most common method is to authenticate by using Application Default Credentials and a client library. Some Google Cloud tools such as the gcloud CLI are able to automatically use the service account to access Google Cloud APIs from a VM. For more information, see Authenticate workloads using service accounts.

If a service account is deleted, applications will no longer have access to Google Cloud resources through that service account. If you delete the default App Engine and Compute Engine service accounts, your VMs will no longer have access to resources in the project. If you're not sure whether a service account is being used, Google recommends disabling the service account before deleting it. Disabled service accounts can be re-enabled if they are still needed.

Example: Access Cloud Storage resources from your VM

After you have configured your VM to use a service account that has the storage.admin role, you can use tools such as the gcloud CLI to manage files that you have stored on Cloud Storage. To access your Cloud Storage resources, complete the following:

  1. Ensure that the service account that is attached to your VM has the roles/storage.admin role.

  2. If your VM uses a custom OS image, install the gcloud CLI. By default, the gcloud CLI is installed on most public OS images that are provided by Google Cloud.

  3. Connect to the VM.

  4. From the VM, use the Google Cloud CLI to manage your Cloud Storage resources.

What's next?

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-08-07 UTC.

[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[[["This document outlines how to create a virtual machine (VM) instance configured to use a user-managed service account, which is a special type of account used by applications or workloads to make authorized API calls to Google Cloud."],["Attaching a user-managed service account to a VM is recommended for applications needing to access Google Cloud resources without end-user involvement, and it is essential to grant appropriate IAM roles to the service account to define its access permissions."],["The process involves creating a new user-managed service account, assigning necessary IAM roles to it, attaching it to the VM, and setting the VM's access scope to the `cloud-platform` scope to enable Google Cloud API access."],["The required permissions to create VMs that use service accounts include specific permissions related to the creation and management of the service account and the VM itself, such as creating and attaching disks, setting metadata, and managing network settings, and can be fulfilled by using a combination of predefined roles."],["After configuring the VM to use a service account, applications can authenticate using Application Default Credentials and client libraries, allowing access to other Google Cloud services; for instance, if the service account has the `storage.admin` role, tools like the gcloud CLI can be used from the VM to manage Cloud Storage resources."]]],[]]

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4