Soluciona problemas de cuentas de servicio predeterminadas
Organiza tus páginas con colecciones
Guarda y categoriza el contenido según tus preferencias.
Para acceder a los recursos de Google Cloud , las instancias de máquinas virtuales (VM) de Compute Engine usan cuentas de servicio. Si borras por accidente la cuenta de servicio predeterminada de Compute Engine, es posible que las aplicaciones que se ejecutan en tus VMs no puedan realizar llamadas a las APIs deGoogle Cloud .
En este documento, se explica cómo recuperar la cuenta de servicio predeterminada de Compute Engine después de borrarla.
Recupera la cuenta de servicio predeterminada de Compute Engine.
Cuando borras una cuenta de servicio, Identity and Access Management (IAM)
la quita de forma permanente después de 30 días. Si borras por accidente la cuenta de servicio predeterminada de Compute Engine, Google Cloud no podrás recuperarla
después de que se quite de forma permanente, y las VMs ya no tendrán acceso a los
recursos del proyecto. En esos casos, si deseas asignar una cuenta de servicio predeterminada de Compute Engine a la VM, crea una cuenta de servicio y configúrala como la cuenta de servicio predeterminada.
Para obtener los permisos que
necesitas para realizar esta tarea,
pídele a tu administrador que te otorgue los
siguientes roles de IAM en tu proyecto:
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-04 (UTC)"],[[["\u003cp\u003eCompute Engine VMs rely on service accounts, including a default one, to access Google Cloud resources.\u003c/p\u003e\n"],["\u003cp\u003eDeleting the Compute Engine default service account can prevent VMs from accessing Google Cloud APIs, and after 30 days Google can no longer recover the service account.\u003c/p\u003e\n"],["\u003cp\u003eIf the default service account was deleted within 30 days, it can be recovered using the \u003ccode\u003eundelete\u003c/code\u003e command, but if it was deleted longer than 30 days ago, then it is permanently removed.\u003c/p\u003e\n"],["\u003cp\u003eIf the default service account is permanently removed, you must create or select an existing service account to set as the new default, then assign the new service account to the desired VMs.\u003c/p\u003e\n"],["\u003cp\u003eTo perform this task, your admin needs to grant you the Compute Admin and Logs Viewer IAM roles on your project, or you may get the needed permissions through custom or other predefined roles.\u003c/p\u003e\n"]]],[],null,["# Troubleshooting default service accounts\n\n*** ** * ** ***\n\nTo access Google Cloud resources, Compute Engine virtual\nmachine (VM) instances use\n[service accounts](/iam/docs/service-account-overview). If you\naccidentally delete the\n[Compute Engine default service account](/compute/docs/access/service-accounts#default_service_account),\napplications that run on your VMs might not be able to make calls to\nGoogle Cloud APIs.\n\nThis document explains how to recover the Compute Engine default service\naccount after it is deleted.\n\nRecover the Compute Engine default service account\n--------------------------------------------------\n\nWhen you delete a service account, Identity and Access Management (IAM)\npermanently removes the service account after 30 days. If you accidentally\ndelete the Compute Engine\ndefault service account, Google Cloud cannot recover the service account\nafter it is permanently removed and then the VMs will no longer have access to\nresources in the project. In such cases, if you want to assign a\nCompute Engine default service account for the VM, create a service account\nand set it as the default service account.\n\n\nTo get the permissions that\nyou need to perform this task,\n\nask your administrator to grant you the\nfollowing IAM roles on your project:\n\n- [Compute Admin](/iam/docs/roles-permissions/compute#compute.admin) (`roles/compute.admin`)\n- [Logs Viewer](/iam/docs/roles-permissions/logging#logging.viewer) (`roles/logging.viewer`)\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nTo recover a deleted Compute Engine default service account, do the following:\n\n1. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n\n Use the following query to validate when the Compute Engine default service\n account was deleted: \n\n ```\n resource.type=\"service_account\"\n protoPayload.methodName=\"google.iam.admin.v1.DeleteServiceAccount\"\n \"PROJECT_NUMBER-compute@developer.gserviceaccount.com\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e with the project number of your\n project.\n\n **If the default service account was deleted less than 30 days ago**:\n\n Use the `undelete` command to recover the service account. For more\n information, see [Undelete a service\n account](/iam/docs/service-accounts-delete-undelete#undeleting).\n\n **If the default service account was deleted more than 30 days ago**:\n 1. [Create a service account](/iam/docs/service-accounts-create#creating) or select an existing service account to set as the new Compute Engine default service account.\n2. If you want VMs to use the newly created default service account, [follow these\n steps](/compute/docs/instances/change-service-account#changeserviceaccountandscopes):\n\n 1. Go to the **VM instances** page.\n\n [Go to VM instances](https://console.cloud.google.com/compute/instances)\n 2. Click the VM instance name for which you want to use the service account.\n\n 3. If the VM is running, click stop **Stop**\n to stop the VM. If there is no **Stop** option, click\n more_vert **More actions \\\u003e** stop **Stop**.\n\n 4. Click **Edit**.\n\n 5. Scroll down to the **Service Account** section.\n\n 6. From the drop-down list, select the service account to assign to the\n instance."]]
