[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[[["\u003cp\u003eThe \u003ccode\u003ecreate-service-account\u003c/code\u003e tool generates Google Cloud Platform service accounts and downloads their key files for Apigee hybrid components, allowing them to make authorized API calls.\u003c/p\u003e\n"],["\u003cp\u003eThis tool, located in the \u003ccode\u003e<var translate="no">HYBRID_ROOT_DIR</var>/tools\u003c/code\u003e directory, requires the \u003ccode\u003egcloud\u003c/code\u003e CLI to be installed and the user to have the \u003ccode\u003eService Account Admin\u003c/code\u003e role.\u003c/p\u003e\n"],["\u003cp\u003eYou can specify the hybrid service (such as \u003ccode\u003eapigee-logger\u003c/code\u003e or \u003ccode\u003eapigee-cassandra\u003c/code\u003e), the output directory for the key file, and optionally the Google Cloud project ID when using this tool.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ecreate-service-account\u003c/code\u003e tool supports multiple components like \u003ccode\u003eapigee-cassandra\u003c/code\u003e, \u003ccode\u003eapigee-metrics\u003c/code\u003e, \u003ccode\u003eapigee-synchronizer\u003c/code\u003e, and others, each with its own specific role.\u003c/p\u003e\n"],["\u003cp\u003eThe tool cannot create \u003ccode\u003eapigee-org-admin\u003c/code\u003e service accounts, which need to be created via \u003ccode\u003egcloud\u003c/code\u003e APIs.\u003c/p\u003e\n"]]],[],null,["| You are currently viewing version 1.4 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nCreates Google Cloud Platform service accounts with roles that allow\nindividual Apigee hybrid components to make authorized API calls and downloads\nthe associated service account key files. You can use\nthe service account key files generated by this command in your configuration overrides file.\n\nThe `create-service-account` tool is located in\n\u003cvar translate=\"no\"\u003eHYBRID_ROOT_DIR\u003c/var\u003e`/tools` directory.\n\nPrerequisites\n\nThe `create-service-account` tool requires that the [`gcloud`](https://cloud.google.com/sdk/gcloud/) CLI be\ninstalled. Users invoking the utility should have the role `Service Account Admin`.\n\nTo get started, be sure your `gcloud` project\nconfiguration is set to the project you created in [Step 2: Create a Google Cloud project](/apigee/docs/hybrid/v1.4/precog-gcpproject): \n\n```\ngcloud config list project\n```\n\n\nIf you need to change the current project ID, use the following command: \n\n```\ngcloud config set project GC_PROJECT_ID\n```\n\nWhere \u003cvar translate=\"no\"\u003eGC_PROJECT_ID\u003c/var\u003e is the project created in [Step 2: Create a Google Cloud project](/apigee/docs/hybrid/v1.4/precog-gcpproject).\n\ncreate-service-account syntax\n\nThe `create-service-account` tool uses the following syntax: \n\n```\ncreate-service-account HYBRID_SERVICE OUTPUT_DIR [GC_PROJECT_ID]\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003eHYBRID_SERVICE\u003c/var\u003e: Specifies the hybrid service that uses the service account. Valid values are:\n - `apigee-cassandra`\n - `apigee-distributed-trace`\n - `apigee-logger`\n - `apigee-mart`\n - `apigee-metrics`\n - `apigee-synchronizer`\n - `apigee-udca`\n - `apigee-watcher` \n\n Note that the `create-service-account` tool cannot create the\n `apigee-org-admin` service account. You must create that either with\n `gcloud` APIs, as described in [Create service accounts](/apigee/docs/hybrid/v1.4/install-download-install#create-service-accounts).\n- \u003cvar translate=\"no\"\u003eOUTPUT_DIR\u003c/var\u003e: The output directory in which to store the downloaded service account key.\n- \u003cvar translate=\"no\"\u003eGCP_PROJECT_ID\u003c/var\u003e: (Optional) Specifies the Google Cloud project ID of the project that is bound to your hybrid-enabled organization. If the Google Cloud project ID is not provided, the tool attempts to retrieve it from the current `gcloud` configuration.\n\nDetailed description\n\nThe `create-service-account` tool:\n\n- Creates [Google Cloud service accounts](https://cloud.google.com/iam/docs/service-accounts) used by hybrid components. The created service account is granted the role required by the specific component to operate.\n- Downloads the service account key to your system. You place the service account keys in your hybrid configuration overrides file, as explained in the hybrid [installation instructions](/apigee/docs/hybrid/v1.4/install-before-begin).\n\nThe tool creates service accounts for the following components:\n\n| Component^\\*^ | Role | Required for basic install? | Description |\n|----------------------------|----------------------------------------------------------------|-----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `apigee-cassandra` | Storage Object Admin `roles/storage.objectAdmin` | | Allows Cassandra backups to Cloud Storage, as described in [Backup and recovery](/apigee/docs/hybrid/v1.4/backup-recovery). |\n| `apigee-distributed-trace` | Cloud Trace Agent `roles/cloudtrace.agent` | | Allows the hybrid runtime plane to participate in distributed request tracing in a format compatible with systems like [Google Cloud Trace](https://cloud.google.com/trace) and [Jaeger](https://www.jaegertracing.io/). |\n| `apigee-logger` | Logs Writer `roles/logging.logWriter` | | Allows logging data collection, as described in [Logging](/apigee/docs/hybrid/v1.4/logging). Only required for non-GKE cluster installations. |\n| `apigee-mart` | Apigee Connect Agent `roles/apigeeconnect.Agent` | | Allows MART service authentication. The Apigee Connect Agent role allows it to communicate securely with the Apigee Connect process, as described in [Using Apigee Connect](/apigee/docs/hybrid/v1.4/apigee-connect). |\n| `apigee-metrics` | Monitoring Metric Writer `roles/monitoring.metricWriter` | | Allows metrics data collection, as described in [Metrics collection overview](/apigee/docs/hybrid/v1.4/metrics-collection). |\n| `apigee-synchronizer` | Apigee Synchronizer Manager `roles/apigee.synchronizerManager` | | Allows the synchronizer to download proxy bundles and environment configuration data. Also enables operation of the trace feature. |\n| `apigee-udca` | Apigee Analytics Agent `roles/apigee.analyticsAgent` | | Allows the transfer of trace, analytics and deployment status data to the management plane. |\n| `apigee-watcher` | Apigee Runtime Agent `roles/apigee.runtimeAgent` | | Apigee Watcher pulls virtual hosts related changes for an org from synchronizer and makes necessary changes to configure istio ingress. |\n| ^\\*^ This name is used in the downloaded service account key's filename. ||||\n\nYou can also create service accounts in the Google Cloud console. See also\n[Creating\nand managing service accounts](https://cloud.google.com/iam/docs/creating-managing-service-accounts).\n\nExample\n\nThe following example creates a new service account for the `apigee-logger`\nservice and places the downloaded key in the `./service-accounts` directory. \n\n```\n./my-hybrid-root/tools/create-service-account apigee-logger ./service-accounts\n```"]]
