Google Cloud 리소스에 액세스하기 위해 Compute Engine 가상 머신(VM) 인스턴스는 서비스 계정을 사용합니다. 실수로 Compute Engine 기본 서비스 계정을 삭제한 경우 VM에서 실행되는 애플리케이션이Google Cloud API를 호출하지 못할 수 있습니다.
이 문서에서는 Compute Engine 기본 서비스 계정이 삭제된 후 이를 복구하는 방법을 설명합니다.
Compute Engine 기본 서비스 계정 복구
서비스 계정을 삭제하면 Identity and Access Management(IAM)가 30일 후 서비스 계정을 영구적으로 삭제합니다. 실수로 Compute Engine 기본 서비스 계정을 삭제한 경우 Google Cloud 에서 서비스 계정을 영구적으로 삭제한 후 서비스 계정을 복구할 수 없으며, 그러면 VM이 더 이상 프로젝트의 리소스에 액세스할 수 없게 됩니다. 이러한 경우 VM에 Compute Engine 기본 서비스 계정을 할당하려면 서비스 계정을 만들고 이를 기본 서비스 계정으로 설정합니다.
이 태스크를 수행하는 데 필요한 권한을 얻으려면 관리자에게 프로젝트에 대한 다음 IAM 역할을 부여해 달라고 요청하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eCompute Engine VMs rely on service accounts, including a default one, to access Google Cloud resources.\u003c/p\u003e\n"],["\u003cp\u003eDeleting the Compute Engine default service account can prevent VMs from accessing Google Cloud APIs, and after 30 days Google can no longer recover the service account.\u003c/p\u003e\n"],["\u003cp\u003eIf the default service account was deleted within 30 days, it can be recovered using the \u003ccode\u003eundelete\u003c/code\u003e command, but if it was deleted longer than 30 days ago, then it is permanently removed.\u003c/p\u003e\n"],["\u003cp\u003eIf the default service account is permanently removed, you must create or select an existing service account to set as the new default, then assign the new service account to the desired VMs.\u003c/p\u003e\n"],["\u003cp\u003eTo perform this task, your admin needs to grant you the Compute Admin and Logs Viewer IAM roles on your project, or you may get the needed permissions through custom or other predefined roles.\u003c/p\u003e\n"]]],[],null,["# Troubleshooting default service accounts\n\n*** ** * ** ***\n\nTo access Google Cloud resources, Compute Engine virtual\nmachine (VM) instances use\n[service accounts](/iam/docs/service-account-overview). If you\naccidentally delete the\n[Compute Engine default service account](/compute/docs/access/service-accounts#default_service_account),\napplications that run on your VMs might not be able to make calls to\nGoogle Cloud APIs.\n\nThis document explains how to recover the Compute Engine default service\naccount after it is deleted.\n\nRecover the Compute Engine default service account\n--------------------------------------------------\n\nWhen you delete a service account, Identity and Access Management (IAM)\npermanently removes the service account after 30 days. If you accidentally\ndelete the Compute Engine\ndefault service account, Google Cloud cannot recover the service account\nafter it is permanently removed and then the VMs will no longer have access to\nresources in the project. In such cases, if you want to assign a\nCompute Engine default service account for the VM, create a service account\nand set it as the default service account.\n\n\nTo get the permissions that\nyou need to perform this task,\n\nask your administrator to grant you the\nfollowing IAM roles on your project:\n\n- [Compute Admin](/iam/docs/roles-permissions/compute#compute.admin) (`roles/compute.admin`)\n- [Logs Viewer](/iam/docs/roles-permissions/logging#logging.viewer) (`roles/logging.viewer`)\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nTo recover a deleted Compute Engine default service account, do the following:\n\n1. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n\n Use the following query to validate when the Compute Engine default service\n account was deleted: \n\n ```\n resource.type=\"service_account\"\n protoPayload.methodName=\"google.iam.admin.v1.DeleteServiceAccount\"\n \"PROJECT_NUMBER-compute@developer.gserviceaccount.com\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e with the project number of your\n project.\n\n **If the default service account was deleted less than 30 days ago**:\n\n Use the `undelete` command to recover the service account. For more\n information, see [Undelete a service\n account](/iam/docs/service-accounts-delete-undelete#undeleting).\n\n **If the default service account was deleted more than 30 days ago**:\n 1. [Create a service account](/iam/docs/service-accounts-create#creating) or select an existing service account to set as the new Compute Engine default service account.\n2. If you want VMs to use the newly created default service account, [follow these\n steps](/compute/docs/instances/change-service-account#changeserviceaccountandscopes):\n\n 1. Go to the **VM instances** page.\n\n [Go to VM instances](https://console.cloud.google.com/compute/instances)\n 2. Click the VM instance name for which you want to use the service account.\n\n 3. If the VM is running, click stop **Stop**\n to stop the VM. If there is no **Stop** option, click\n more_vert **More actions \\\u003e** stop **Stop**.\n\n 4. Click **Edit**.\n\n 5. Scroll down to the **Service Account** section.\n\n 6. From the drop-down list, select the service account to assign to the\n instance."]]
