Watch The Video Or Read The Article (Or Do Both )

What is Service Account?

A service account in GCP is a special kind of account used by applications or virtual machines (VMs) to interact with other GCP services. Unlike user accounts, which are intended for human users, service accounts are designed for non-human entities that need to authenticate and authorize actions on GCP resources.

Service accounts allow for secure and efficient interaction between different GCP services without the need for human intervention. This is especially useful for automated workflows, microservices architectures, and when employing continuous integration and deployment pipelines.

As you can see in the above picture, Virtual Machine running in Google Cloud will be able to communicate with another Google product i.e. in this scenario, it's Google Cloud Storage through service account. Basically instead of human doing the communcation, service account is doing the communication work between VM running in GCP and Google Cloud Storage.

Types of Service Account

There are mainlu three types of service account -

• User-managed service account - These service accounts are created by users so should be managed by users as well. 
• Default service account - These service accounts are created automatically by Google Cloud platform when user enable some services. User is responsible to manage these service accounts.
• Service agents - These service accounts are created and managed both by Google Cloud.

Creating Service Account

Creating a service account is basicaly adding a new team members to your project, but as mentioned earlier service accounts belong to the application rather than an individual end user. Below is the command to create Service Account.

The above command will create a service account with the name "My New Service Account" like shown in the below picture

Granting Roles to Service Accounts

When granting IAM roles, you can treat a service account either as a resource or as an identity.

Your application uses a service account as an identity to authenticate to Google Cloud services. For example, if you have a Compute Engine Virtual Machine (VM) running as a service account, you can grant the editor role to the service account (the identity) for a project (the resource).

At the same time, you might also want to control who can start the VM. You can do this by granting a user (the identity) the serviceAccountUser role for the service account (the resource).

In the above command, I am granting roles to the service account

Use Case - Create Virtual Machine Using Service Accoun to Talk to Cloud Storage

First I will create the service account with the below command

With Service Account being created, I will create the Virtual Machine. During creation, I will choose the new Service accounts under Identity and API access section. Also under Access scopes, select Allow default access. Rest all options will be by default.

With Virtual Machine selected, if I describe the virtual machine by running the below command, I will see the service account is correct, but the scope is not correct. Scope should be cloud-platform in order Service Account to communicate with other Google Cloud services.

gcloud compute instances describe [INSTANCE NAME]

In order to add the correct scope, first I need to stop the virtual machine and then execute the below command. After successful execution, I need to restart the virtual machine. Now if I execute the same commane again to describe the virtual machine instance, I will see the scope is being updated with correct one.

gcloud compute instances set-service-account [INSTANCE NAME] \
--scopes=cloud-platform \
--service-account=[SERVICE ACCOUNT NAME] \
--zone=[VM ZONE]

Now for the second part, I will create the Cloud storage bucket - suddeb-demo. If I login to virtual machine now with ssh and from inside virtual machine if I try to execute the command to list down everything there inside bucket, I will be given the permission denied error.

gcloud storage ls gs://suddeb-demo

The reason behind Service Account is not having the permission needed to perform the operation. For which I will be adding the role Storage Object Viewer to the service as shown below. And then I should be able to perform the command to list down everything within bucket.

Now to perform copy from virtual machine to cloud storage bucket, if I execute the below command, I will be again given the permission denied.

gcloud storage cp file.txt gs://suddeb-demo/

The reason behind is that Service account doesn't have the the Storage Object Creator permission. Once I add the role to the service account, I will be able to execut the above command to copy files from virtual machine to cloud storage bucket.

• Principle of Least Privilege: Assign the minimum necessary permissions to service accounts to reduce security risks.
• Rotate Keys Regularly: If you are using key files for authentication, ensure they are rotated regularly to minimize the risk of compromise.
• Use Different Accounts for Different Applications: This helps in isolating services and controlling the scope of access for each service.
• Monitor and Audit: Regularly review IAM policies and monitor the activities of service accounts using Cloud Audit Logs.

Final Thoughts

Disclaimer

This article is not endorsed by Salesforce, Google, or any other company in any way. I shared my knowledge on this topic in this blog post. Please always refer to Official Documentation for the latest information.

0 Comments