대부분의 사용 사례에서는 사용자 인증 정보를 사용하여 gcloud CLI에 로그인할 수 있지만 서비스 계정을 사용할 수도 있습니다.
로컬 환경에서 gcloud CLI에 로그인하면 이 도구가 사용자 액세스를 처리하고 홈 디렉터리에서 토큰을 새로고침합니다. 파일 시스템에 대해 액세스가 있는 모든 사용자가 이러한 사용자 인증 정보에 액세스할 수 있습니다. 자세한 내용은 Google Cloud CLI에서 손상된 OAuth 토큰 문제 해결을 참조하세요.
다음 표는 gcloud CLI에 로그인하는 옵션 및 이 옵션이 Google API를 인증 및 승인하는 도구에서 사용하는 사용자 인증 정보에 미치는 영향을 설명합니다.
Compute Engine 가상 머신과 같은 Google Cloud 컴퓨팅 리소스에서 gcloud CLI를 사용하는 경우 메타데이터 서버를 사용하여 호스팅 컴퓨팅 리소스에서 사용자 인증 정보와 구성 정보를 가져오기 때문에 gcloud CLI를 초기화하거나 로그인할 필요가 없습니다.
사용자 인증 정보 유형
인증 명령어
참고
추가 정보
서비스 계정
해당 사항 없음
gcloud CLI는 모든 Google API에 대한 인증과 승인을 위해 컴퓨팅 리소스에 연결된 서비스 계정을 사용합니다.
gcloud CLI에 로그인할 때 gcloud auth login 명령어를 사용하여 gcloud CLI에 대해 주 구성원을 인증합니다.
gcloud CLI는 Google Cloud 리소스 및 서비스 관리를 위해 인증 및 승인에 이 주 구성원을 사용합니다. 이것이 gcloud CLI 인증 구성입니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-05-15(UTC)"],[[["\u003cp\u003eThe gcloud CLI, a command-line tool for Google Cloud administration, requires different sign-in methods based on the environment: local, Cloud Shell, or Google Cloud compute resources.\u003c/p\u003e\n"],["\u003cp\u003eIn local environments, users can sign in to the gcloud CLI using either their user credentials or a service account, with the tool storing access tokens in the user's home directory.\u003c/p\u003e\n"],["\u003cp\u003eCloud Shell users do not need to sign in to the gcloud CLI but must authorize their account for development tools, while compute resources automatically provide credentials to the gcloud CLI.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcloud auth login\u003c/code\u003e command authenticates the gcloud CLI for accessing Google Cloud, whereas \u003ccode\u003egcloud auth application-default login\u003c/code\u003e configures Application Default Credentials (ADC) for the local environment.\u003c/p\u003e\n"],["\u003cp\u003eWorkforce and Workload Identity Federation allow users and workloads outside of Google Cloud to access resources, and the gcloud CLI supports signing in using these methods.\u003c/p\u003e\n"]]],[],null,["This page describes various ways to sign in to the gcloud CLI.\nThe Google Cloud CLI is a command-line tool you can use for Google Cloud\nadministration. Most services support the gcloud CLI.\n\nIf you plan to use client libraries or third-party development tools that\nsupport Application Default Credentials (ADC) in a local development\nenvironment, you need to configure ADC in your local environment. For more\ninformation, see\n[Set up Application Default Credentials for a local development environment](/docs/authentication/set-up-adc-local-dev-environment).\n\nHow you authenticate to and use the gcloud CLI depends on where you\nare running the tool:\n\n- [In a local environment](#local)\n- [Using Cloud Shell](#cloud-shell)\n- [On Google Cloud compute resources](#on-gcp)\n\nLocal environment\n\nFor most use cases, you can use your user credentials to\nsign in to the gcloud CLI, but you can also use a service account.\n\nWhen you sign in to the gcloud CLI in a local environment, the tool\nplaces your access and refresh tokens in your home directory. Any user with\naccess to your file system can use those credentials. For more information, see\n[Mitigating compromised OAuth tokens for Google Cloud CLI](/architecture/bps-for-mitigating-gcloud-oauth-tokens).\n\nThe following table describes your options for signing in to the\ngcloud CLI and how that affects the credentials used by the tool\nto authenticate and authorize to Google APIs.\n\n| Credential type | Authentication command | Notes | More information |\n|------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| User credentials | One of the following: - [`gcloud init`](/sdk/gcloud/reference/init): Authorizes access and performs other common setup steps. - [`gcloud auth login`](/sdk/gcloud/reference/auth/login): Authorizes access only. | The gcloud CLI uses your user credentials for authentication and authorization for all Google APIs. To use a service account for authorization to Google APIs, use [service account impersonation](/docs/authentication/use-service-account-impersonation#gcloud). | - [Initialize the gcloud CLI](/sdk/docs/initializing) - [Use service account impersonation](/docs/authentication/use-service-account-impersonation#gcloud) |\n| User credentials | 1. `gcloud config set auth/login_config_file `\u003cvar translate=\"no\"\u003eWORKFORCE_IDENTITY_FEDERATION_LOGIN_CONFIGURATION_FILE\u003c/var\u003e 2. [`gcloud auth login`](/sdk/gcloud/reference/auth/login) | Workforce Identity Federation enables users managed by an identity provider other than Google to access Google Cloud resources. | - [Sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud) - [Workforce Identity Federation](/iam/docs/workforce-identity-federation) |\n| Service account | [`gcloud auth login --cred-file=`\u003cvar translate=\"no\"\u003eWORKLOAD_IDENTITY_FEDERATION_CREDENTIAL_FILE\u003c/var\u003e](/sdk/gcloud/reference/auth/login) | Workload Identity Federation enables workloads running outside of Google Cloud to access Google Cloud resources. | [Authenticate a workload](/iam/docs/workload-identity-federation-with-other-providers#authenticate) |\n| Service account | [`gcloud auth login --cred-file=`\u003cvar translate=\"no\"\u003eSERVICE_ACCT_KEY\u003c/var\u003e](/sdk/gcloud/reference/auth/login) | This method is not recommended, because using service account keys increases risk. To use a service account for authorization to Google APIs, sign in to the gcloud CLI with your user credentials, and then use [service account impersonation](/docs/authentication/use-service-account-impersonation#gcloud). | - [Best practices for managing service account keys](/iam/docs/best-practices-for-managing-service-account-keys) - [Use service account impersonation](/docs/authentication/use-service-account-impersonation#gcloud) |\n\nCloud Shell\n\nWhen you use Cloud Shell, you don't need to sign in to the\ngcloud CLI, but you do need to authorize the use of your account\nbefore using any development tools from Cloud Shell. After you do that,\nthe gcloud CLI uses your user credentials to access Google APIs.\n\nFor more information, see [Authorize with Cloud Shell](/shell/docs/auth).\n\n\nGoogle Cloud compute resources\n\nWhen you use the gcloud CLI on Google Cloud compute resources\nsuch as Compute Engine virtual machines, you don't need to initialize or sign\nin to the gcloud CLI, because it gets its credentials and\nconfiguration information from the hosting compute resource by using the\nmetadata server.\n\n| Credential type | Authentication command | Notes | More information |\n|-----------------|------------------------|------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------|\n| Service account | Not applicable | The gcloud CLI uses the service account attached to the compute resource for authentication and authorization for all Google APIs. | [Set up ADC for a resource with an attached service account](/docs/authentication/set-up-adc-attached-service-account) |\n\ngcloud CLI authentication configuration and ADC configuration\n\nWhen you sign in to the gcloud CLI, you use the\n[`gcloud auth login` command](/sdk/gcloud/reference/auth/login) to authenticate a principal to the gcloud CLI.\nThe gcloud CLI uses that principal for authentication and authorization to\nmanage Google Cloud resources and services. This is your *gcloud CLI authentication configuration*.\n\nWhen you use the gcloud CLI to configure ADC, you use\nthe [`gcloud auth application-default login`](/sdk/gcloud/reference/auth/application-default/login) command. This\ncommand uses the principal you provide to configure ADC for your\nlocal environment. This is your *ADC configuration*.\n\nYour gcloud CLI authentication configuration is distinct from your\nADC configuration. They can use the same principal or different principals. The\ngcloud CLI does not use ADC to access Google Cloud resources.\n\nThe following table shows the two commands and what they do:\n\n| Command | Description |\n|-------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|\n| [`gcloud auth login`](/sdk/gcloud/reference/auth/login) | Accepts credentials that are used to authenticate to and authorize access to Google Cloud services. |\n| [`gcloud auth application-default login`](/sdk/gcloud/reference/auth/application-default/login) | Generates a local ADC file based on the credentials you provide to the command. |\n\nGenerally you use the same account to sign in to the gcloud CLI\nand to configure ADC, but you can use different accounts if needed.\n\nWhat's next\n\n- Learn more about [how ADC finds credentials](/docs/authentication/application-default-credentials).\n- [Authenticate for using Cloud Client Libraries](/docs/authentication/client-libraries).\n- Explore [authentication methods](/docs/authentication)."]]
