Console
    Contact Us Start free

    Configure a service account in Application Design Center

    A service account is a special kind of account used by an application or compute workload, such as a Compute Engine instance, rather than a person. A service account is identified by its email address, which is unique to the account. For more information, see Service accounts overview .

    This document describes the connections and parameters you can configure when using App Design Center to create a service account. The configuration parameters are based on the terraform-google-service-accounts Terraform module.

    Component connections

    The following table includes the components that you can connect to a service account, and the resulting updates to your application and its generated Terraform code.

    Connected component

    Application updates

    Background information

    Compute Engine instance template

    • The Compute Engine instance template uses the connected service account instead of creating a new service account. The connected service account is used for authentication and authorization to other Google Cloud services.
    • The service account email and IAM information are added to the Compute Engine instance template.
    Create a VM that uses a user-managed service account

    Secret Manager

    • The service account can access the secret data.
    • The roles/secretmanager.secretAccessor role is assigned to the service account.
    Manage access to secrets

    BigQuery

    • The service account can be used by services, such as Cloud Run, to read and modify data in the BigQuery dataset.
    • The BigQuery roles/bigquery.dataEditor role is added to the service account.
    BigQuery IAM roles and permissions

    Cloud Run

    • The Cloud Run service uses the service account as a service identity .
    • The roles/run.invoker role is added to the service account.
    • The service account email and IAM information are added to the Cloud Run instance.
    Authenticating service-to-service

    Cloud SQL (MySQL)

    • The service account can connect to the Cloud SQL (MySQL) instance.
    • The roles/cloudsql.instanceUser and roles/cloudsql.client roles are added to the service account.
    • The service account IAM information is added to the Cloud SQL instance.
    Roles and permissions

    Cloud SQL (PostgreSQL)

    • The service account can connect to the Cloud SQL (PostgreSQL) instance.
    • The roles/cloudsql.instanceUser and roles/cloudsql.client roles are added to the service account.
    • The service account IAM information is added to the Cloud SQL instance.
    Roles and permissions

    Cloud Storage

    • The service account can manage objects in the Cloud Storage bucket.
    • The service account IAM information is added to the Cloud Storage bucket.
    • The roles/storage.objectAdmin role is assigned to the service account.
    Set and manage IAM policies on buckets

    Memorystore for Redis

    • The service account can manage the Memorystore for Redis instance.
    • The roles/redis.editor role is added to the service account.
    The Memorystore for Redis service account

    Pub/Sub

    • The service account can manage Pub/Sub topics, and pull messages from subscriptions.
    • The roles/pubsub.editor role is added to the service account.
    • The service account name and email information is added to the Pub/Sub pull subscription.
    Access control with IAM

    Spanner

    • The service account has access to the Spanner instance.
    • The service account is added as an IAM user to the Spanner instance.
    Configure an instance with a service account

    Vertex AI

    • The service account can interact with Vertex AI services.
    • The roles/aiplatform.user role is added to the service account.
    Vertex AI access control with IAM

    Required configuration parameters

    If your template includes a service account component, you must configure the following parameters before you deploy.

    Parameter name

    Description and constraints

    Background information

    Project ID

    The project where you want to create the service account resource.

    		 Configure components

    Name

    An identifier that must be between 6 and 30 characters. Can contain lowercase alphanumeric characters and dashes. For example, my-service-account .

    		 Create service accounts

    Optional configuration parameters

    The following parameters are optional. To display advanced parameters, in the Configurationarea, select Show advanced fields.

    Parameter name

    Description and constraint information

    Background information

    Display Name

    A user-readable name for the service account.

    		 Create service accounts

    Description

    A user-readable description.

    		 Create service accounts
    Project roles
    		 project_roles Manage access to projects, folders, and organizations
    Design a Mobile Site
    View Site in Mobile | Classic
    Share by: