This document describes how to use a service account to connect to Compute Engine virtual machine (VM) instances using SSH. Setting up SSH for a service account enables you to configure apps to use SSH , which can help you to automate your workloads.
Before you begin
- Create a service account .
- If you haven't already, set up authentication
.
Authentication verifies your identity for access to Google Cloud services and APIs. To run
code or samples from a local development environment, you can authenticate to
Compute Engine by selecting one of the following options:
-
Install the Google Cloud CLI. After installation, initialize the Google Cloud CLI by running the following command:
gcloud init
If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity .
- Set a default region and zone .
-
Manually connect to VMs as a service account
To connect to VMs as a service account, use one of the following methods:
Directly impersonate service account
Permissions required for this task
To perform this task, you must have the following permissions :
- All the permissions included in the Service Account Token Creator role (
roles/iam.serviceAccountTokenCreator) , on the service account. For details about how to grant this role on a singular service account, see Manage access to service accounts . - If you use OS Login, you require all the permissions included one of the OS Login IAM roles on the service account.
- If you don't use OS Login, the service account also requires the
compute.projects.setCommonInstanceMetadatapermission.
Use the gcloud CLI --impersonate-service-account
flag
to connect directly to a VM using a service account's identity. Run the
following command to connect to a VM as a service account:
gcloud compute ssh VM_NAME \ --impersonate-service-account= SERVICE_ACCOUNT_EMAIL
Replace the following:
-
VM_NAME: the name of the VM you want to connect to the service account as. -
SERVICE_ACCOUNT_EMAIL: the email address associated with the service account.
