Risoluzione dei problemi relativi agli account di servizio predefiniti
Mantieni tutto organizzato con le raccolte
Salva e classifica i contenuti in base alle tue preferenze.
Per accedere alle risorse Google Cloud , le istanze di macchine virtuali (VM) Compute Engine utilizzano i service account. Se elimini
accidentalmente il
service account Compute Engine predefinito,
le applicazioni in esecuzione sulle tue VM potrebbero non essere in grado di effettuare chiamate alle
APIGoogle Cloud .
Questo documento spiega come recuperare il service account predefinito di Compute Engine dopo l'eliminazione.
Recuperare l'account di servizio Compute Engine predefinito
Quando elimini un account di servizio, Identity and Access Management (IAM)
lo rimuove definitivamente dopo 30 giorni. Se elimini per errore
ilaccount di serviziot predefinito
di Compute Engine, Google Cloud non puoi recuperarlo
dopo la rimozione definitiva e le VM non avranno più accesso
alle risorse del progetto. In questi casi, se vuoi assegnare un account di servizio predefinito di Compute Engine alla VM, crea un account di servizio e impostalo come account di servizio predefinito.
Per ottenere le autorizzazioni
necessarie per eseguire questa attività,
chiedi all'amministratore di concederti i
seguenti ruoli IAM nel tuo progetto:
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-04 UTC."],[[["\u003cp\u003eCompute Engine VMs rely on service accounts, including a default one, to access Google Cloud resources.\u003c/p\u003e\n"],["\u003cp\u003eDeleting the Compute Engine default service account can prevent VMs from accessing Google Cloud APIs, and after 30 days Google can no longer recover the service account.\u003c/p\u003e\n"],["\u003cp\u003eIf the default service account was deleted within 30 days, it can be recovered using the \u003ccode\u003eundelete\u003c/code\u003e command, but if it was deleted longer than 30 days ago, then it is permanently removed.\u003c/p\u003e\n"],["\u003cp\u003eIf the default service account is permanently removed, you must create or select an existing service account to set as the new default, then assign the new service account to the desired VMs.\u003c/p\u003e\n"],["\u003cp\u003eTo perform this task, your admin needs to grant you the Compute Admin and Logs Viewer IAM roles on your project, or you may get the needed permissions through custom or other predefined roles.\u003c/p\u003e\n"]]],[],null,["# Troubleshooting default service accounts\n\n*** ** * ** ***\n\nTo access Google Cloud resources, Compute Engine virtual\nmachine (VM) instances use\n[service accounts](/iam/docs/service-account-overview). If you\naccidentally delete the\n[Compute Engine default service account](/compute/docs/access/service-accounts#default_service_account),\napplications that run on your VMs might not be able to make calls to\nGoogle Cloud APIs.\n\nThis document explains how to recover the Compute Engine default service\naccount after it is deleted.\n\nRecover the Compute Engine default service account\n--------------------------------------------------\n\nWhen you delete a service account, Identity and Access Management (IAM)\npermanently removes the service account after 30 days. If you accidentally\ndelete the Compute Engine\ndefault service account, Google Cloud cannot recover the service account\nafter it is permanently removed and then the VMs will no longer have access to\nresources in the project. In such cases, if you want to assign a\nCompute Engine default service account for the VM, create a service account\nand set it as the default service account.\n\n\nTo get the permissions that\nyou need to perform this task,\n\nask your administrator to grant you the\nfollowing IAM roles on your project:\n\n- [Compute Admin](/iam/docs/roles-permissions/compute#compute.admin) (`roles/compute.admin`)\n- [Logs Viewer](/iam/docs/roles-permissions/logging#logging.viewer) (`roles/logging.viewer`)\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nTo recover a deleted Compute Engine default service account, do the following:\n\n1. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n\n Use the following query to validate when the Compute Engine default service\n account was deleted: \n\n ```\n resource.type=\"service_account\"\n protoPayload.methodName=\"google.iam.admin.v1.DeleteServiceAccount\"\n \"PROJECT_NUMBER-compute@developer.gserviceaccount.com\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e with the project number of your\n project.\n\n **If the default service account was deleted less than 30 days ago**:\n\n Use the `undelete` command to recover the service account. For more\n information, see [Undelete a service\n account](/iam/docs/service-accounts-delete-undelete#undeleting).\n\n **If the default service account was deleted more than 30 days ago**:\n 1. [Create a service account](/iam/docs/service-accounts-create#creating) or select an existing service account to set as the new Compute Engine default service account.\n2. If you want VMs to use the newly created default service account, [follow these\n steps](/compute/docs/instances/change-service-account#changeserviceaccountandscopes):\n\n 1. Go to the **VM instances** page.\n\n [Go to VM instances](https://console.cloud.google.com/compute/instances)\n 2. Click the VM instance name for which you want to use the service account.\n\n 3. If the VM is running, click stop **Stop**\n to stop the VM. If there is no **Stop** option, click\n more_vert **More actions \\\u003e** stop **Stop**.\n\n 4. Click **Edit**.\n\n 5. Scroll down to the **Service Account** section.\n\n 6. From the drop-down list, select the service account to assign to the\n instance."]]
