This page explains how to create and manage service accounts using the
Identity and Access Management (IAM) API, the Google Cloud Console, and the gcloud
command-
line tool.
By default, each project can have up to 100 service accounts that control access to your resources. You can request a quota increase if necessary. Learn more about quotas and limits.
Before you begin
- Understand IAM service accounts
- Install the
gcloud
command-line tool
Required permissions
To allow a user to manage service accounts, grant one of the following roles:
- Service Account User (
roles/iam.serviceAccountUser
): Includes permissions to list service accounts, get details about a service account, and impersonate a service account. - Service Account Admin (
roles/iam.serviceAccountAdmin
): Includes permissions to list service accounts and get details about a service account. Also includes permissions to create, update, and delete service accounts, and to view or change the IAM policy on a service account.
To learn more about these roles, see Service Accounts roles.
IAM basic roles also contain permissions to manage service accounts. You should not grant basic roles in a production environment, but you can grant them in a development or test environment.
Creating a service account
Creating a service account is similar to adding a member to your project, but the service account belongs to your applications rather than an individual end user.
When you create a service account, you must provide an alphanumeric ID
(sa-name
in the samples below), such as
my-service-account
. The ID must be between 6 and 30 characters, and can
contain lowercase alphanumeric characters and dashes. After you create a service
account, you cannot change its name.
The service account's name is a unique identifier; it will appear in the service
account's email address that is provisioned during creation, such as
sa-name@project-id.iam.gserviceaccount.com
.
Each service account also has a unique numeric ID, which is generated automatically.
You also provide the following information when you create a service account:
sa-description
is an optional description for the service account.sa-display-name
is a friendly name for the service account.project-id
is the ID of your Google Cloud project.
To create a service account, at minimum the user must be granted the
Service Account Admin role (roles/iam.serviceAccountAdmin
) or the Editor basic
role (roles/editor
).
You should not grant basic roles in a production environment, but you can grant them in a
development or test environment.
After you create a service account, you might need to wait for 60 seconds or more before you use the service account. If you try to use a service account immediately after you create it, and you receive an error, wait at least 60 seconds and try again.
Console
-
In the Cloud Console, go to the Service accounts page.
Go to the Service accounts page - Select a project.
- Click Create service account.
-
Enter a service account name to display in the Cloud Console.
The Cloud Console generates a service account ID based on this name. Edit the ID if necessary. You cannot change the ID later.
- Optional: Enter a description of the service account.
-
If you do not want to set access controls now, click Done to finish creating the service account.
To set access controls now, click Create and continue to the next step.
- Optional: Choose one or more IAM roles to grant to the service account on the project.
- When you are done adding roles, click Continue.
- Optional: In the Service account users role field, add members that can impersonate the service account.
- Optional: In the Service account admins role field, add members that can manage the service account.
- Click Done to finish creating the service account.
gcloud
-
To create the service account, run the
gcloud iam service-accounts create
command:gcloud iam service-accounts create SERVICE_ACCOUNT_ID \ --description="DESCRIPTION" \ --display-name="DISPLAY_NAME"
Replace the following values:
-
SERVICE_ACCOUNT_ID
: The ID for the service account. -
DESCRIPTION
: Optional. A description of the service account. -
DISPLAY_NAME
: A service account name to display in the Cloud Console.
-
-
Optional: To grant your service account an IAM role on your project, run the
gcloud projects add-iam-policy-binding
command:gcloud projects add-iam-policy-binding PROJECT_ID \ --member="serviceAccount:SERVICE_ACCOUNT_ID@PROJECT_ID.iam.gserviceaccount.com" \ --role="ROLE_NAME"
Replace the following values:
-
PROJECT_ID
: The project id. -
SERVICE_ACCOUNT_ID
: The service account ID. -
ROLE_NAME
: A role name, such asroles/compute.osLogin
.
-
-
Optional: To allow users to impersonate the service account, run the
gcloud iam service-accounts add-iam-policy-binding
command to grant a user the Service Account User role (roles/iam.serviceAccountUser
) on the service account:gcloud iam service-accounts add-iam-policy-binding \ SERVICE_ACCOUNT_ID@PROJECT_ID.iam.gserviceaccount.com \ --member="user:USER_EMAIL" \ --role="roles/iam.serviceAccountUser"
Replace the following values:
-
PROJECT_ID
: The project ID. -
SERVICE_ACCOUNT_ID
: The service account ID. -
USER_EMAIL
: The email address for the user.
-
REST
The
serviceAccounts.create
method creates a service account.
Before using any of the request data below, make the following replacements:
PROJECT_ID
: Your Google Cloud project ID. Project IDs are alphanumeric strings, likemy-project
.SA_NAME
: The alphanumeric ID of your service account. This name must be between 6 and 30 characters, and can contain lowercase alphanumeric characters and dashes.SA_DESCRIPTION
: Optional. A description for the service account.SA_DISPLAY_NAME
: A human-readable name for the service account.
HTTP method and URL:
POST https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts
Request JSON body:
{ "accountId": "SA_NAME", "serviceAccount": { "description": "SA_DESCRIPTION", "displayName": "SA_DISPLAY_NAME" } }
To send your request, expand one of these options:
You should receive a JSON response similar to the following:
{ "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com", "projectId": "my-project", "uniqueId": "123456789012345678901", "email": "my-service-account@my-project.iam.gserviceaccount.com", "displayName": "My service account", "etag": "BwUp3rVlzes=", "description": "A service account for running jobs in my project", "oauth2ClientId": "987654321098765432109" }
C#
Before trying this sample, follow the C# setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM C# API reference documentation.
Go
Before trying this sample, follow the Go setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Go API reference documentation.
Java
Before trying this sample, follow the Java setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Java API reference documentation.
Python
Before trying this sample, follow the Python setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Python API reference documentation.
After you create a service account, grant one or more roles to the service account so that it can act on your behalf.
Also, if the service account needs to access resources in other projects, you usually must enable the APIs for those resources in the project where you created the service account.
Listing service accounts
When listing service accounts, you can specify parameters to limit the number of
service accounts to include in the response. You can then use
ListServiceAccountsResponse.next_page_token
in a subsequent request to list
the remaining service accounts.
Use this method to audit service accounts and keys, or to build custom tools for managing service accounts.
To list service accounts, at minimum the user must be granted the
Service Account User role (roles/iam.serviceAccountUser
) or the Viewer basic
role (roles/viewer
).
Console
In the Cloud Console, go to the Service accounts page.
Select a project.
The Service accounts page lists all of the user-managed service accounts in the project you selected. The page does not list Google-managed service accounts.
gcloud
Execute the gcloud iam service-accounts list
command to list all service accounts in a project.
Command:
gcloud iam service-accounts list
The output is the list of all service accounts in the project:
NAME EMAIL sa-display-name-1 sa-name-1@project-id.iam.gserviceaccount.com sa-display-name-2 sa-name-2@project-id.iam.gserviceaccount.com
REST
The
serviceAccounts.list
method lists every service account in your project.
Before using any of the request data below, make the following replacements:
PROJECT_ID
: Your Google Cloud project ID. Project IDs are alphanumeric strings, likemy-project
.
HTTP method and URL:
GET https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts
To send your request, expand one of these options:
You should receive a JSON response similar to the following:
{ "accounts": [ { "name": "projects/my-project/serviceAccounts/sa-1@my-project.iam.gserviceaccount.com", "projectId": "my-project", "uniqueId": "123456789012345678901", "email": "sa-1@my-project.iam.gserviceaccount.com", "description": "My first service account", "displayName": "Service account 1", "etag": "BwUpTsLVUkQ=", "oauth2ClientId": "987654321098765432109" }, { "name": "projects/my-project/serviceAccounts/sa-2@my-project.iam.gserviceaccount.com", "projectId": "my-project", "uniqueId": "234567890123456789012", "email": "sa-2@my-project.iam.gserviceaccount.com", "description": "My second service account", "displayName": "Service account 2", "etag": "UkQpTwBVUsL=", "oauth2ClientId": "876543210987654321098" } ] }
C#
Before trying this sample, follow the C# setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM C# API reference documentation.
Go
Before trying this sample, follow the Go setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Go API reference documentation.
Java
Before trying this sample, follow the Java setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Java API reference documentation.
Python
Before trying this sample, follow the Python setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Python API reference documentation.
Updating a service account
The display name (friendly name) and description of a service account are commonly used to capture additional information about the service account, such as the purpose of the service account or a contact person for the account.
To update the name or description of a service account, at minimum the user must
be granted the Service Account Admin role (roles/iam.serviceAccountAdmin
) or
the Editor basic role (roles/editor
).
Console
In the Cloud Console, go to the Service accounts page.
Select a project.
Click the email address of the service account that you want to rename.
Enter the new name in the Name box, then click Save.
gcloud
Execute the gcloud iam service-accounts update
command to update a service account.
Command:
gcloud iam service-accounts update \ sa-name@project-id.iam.gserviceaccount.com \ --description="updated-sa-description" \ --display-name="updated-display-name"
The output is the renamed service account:
description: updated-sa-description displayName: updated-display-name name: projects/project-id/serviceAccounts/sa-name@project-id.iam.gserviceaccount.com
REST
The
serviceAccounts.patch
method updates a service account.
Before using any of the request data below, make the following replacements:
PROJECT_ID
: Your Google Cloud project ID. Project IDs are alphanumeric strings, likemy-project
.SA_ID
: The ID of your service account. This can either be the service account's email address in the formSA_NAME@PROJECT_ID.iam.gserviceaccount.com
, or the service account's unique numeric ID.SA_NAME
: The alphanumeric ID of your service account. This name must be between 6 and 30 characters, and can contain lowercase alphanumeric characters and dashes.- Replace at least one of the following:
UPDATED_DISPLAY_NAME
: A new display name for your service account.UPDATED_DESCRIPTION
: A new description for your service account.
HTTP method and URL:
PATCH https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_ID
Request JSON body:
{ "serviceAccount": { "email": "SA_NAME@PROJECT_ID.iam.gserviceaccount.com", "displayName": "UPDATED_DISPLAY_NAME", "description": "UPDATED_DESCRIPTION" }, "updateMask": "displayName,description" }
To send your request, expand one of these options:
You should receive a JSON response similar to the following:
{ "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com", "displayName": "My updated service account", "description": "An updated description of my service account" }
C#
Before trying this sample, follow the C# setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM C# API reference documentation.
Go
Before trying this sample, follow the Go setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Go API reference documentation.
Java
Before trying this sample, follow the Java setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Java API reference documentation.
Python
Before trying this sample, follow the Python setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Python API reference documentation.
Disabling a service account
Similar to deleting a service account, when you disable a service account, applications will no longer have access to Google Cloud resources through that service account. If you disable the default App Engine and Compute Engine service accounts, the instances will no longer have access to resources in the project. If you attempt to disable an already disabled service account, it will have no effect.
Unlike deleting a service account, disabled service accounts can easily be re-enabled as necessary. We recommend disabling a service account before deleting it to make sure no critical applications are using the service account.
To disable a service account, at minimum the user must be granted the
Service Account Admin role (roles/iam.serviceAccountAdmin
) or the Editor basic
role (roles/editor
).
Console
In the Cloud Console, go to the Service accounts page.
Select a project.
Click the name of the service account that you want to disable.
Under Service account status, click Disable service account, then click Disable to confirm the change.
gcloud
Execute the gcloud iam service-accounts disable
command to disable a service account.
Command:
gcloud iam service-accounts disable sa-name@project-id.iam.gserviceaccount.com
Output:
Disabled service account sa-name@project-id.iam.gserviceaccount.com
REST
The
serviceAccounts.disable
method immediately disables a service account.
Before using any of the request data below, make the following replacements:
PROJECT_ID
: Your Google Cloud project ID. Project IDs are alphanumeric strings, likemy-project
.SA_ID
: The ID of your service account. This can either be the service account's email address in the formSA_NAME@PROJECT_ID.iam.gserviceaccount.com
, or the service account's unique numeric ID.
HTTP method and URL:
POST https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_ID:disable
To send your request, expand one of these options:
If successful, the response body will be empty.
C#
Before trying this sample, follow the C# setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM C# API reference documentation.
Go
Before trying this sample, follow the Go setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Go API reference documentation.
Java
Before trying this sample, follow the Java setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Java API reference documentation.
Python
Before trying this sample, follow the Python setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Python API reference documentation.
Enabling a service account
After enabling a disabled service account, applications will regain access to Google Cloud resources through that service account.
You can enable a disabled service account whenever you need to. If you attempt to enable an already enabled service account, it will have no effect.
To enable a service account, at minimum the user must be granted the
Service Account Admin role (roles/iam.serviceAccountAdmin
) or the Editor basic
role (roles/editor
).
Console
In the Cloud Console, go to the Service accounts page.
Select a project.
Click the name of the service account that you want to enable.
Under Service account status, click Enable service account, then click Enable to confirm the change.
gcloud
Execute the gcloud iam service-accounts enable
command to enable a service account.
Command:
gcloud iam service-accounts enable sa-name@project-id.iam.gserviceaccount.com
Output:
Enabled service account sa-name@project-id.iam.gserviceaccount.com
REST
The
serviceAccounts.enable
method enables a previously disabled service account.
Before using any of the request data below, make the following replacements:
PROJECT_ID
: Your Google Cloud project ID. Project IDs are alphanumeric strings, likemy-project
.SA_ID
: The ID of your service account. This can either be the service account's email address in the formSA_NAME@PROJECT_ID.iam.gserviceaccount.com
, or the service account's unique numeric ID.
HTTP method and URL:
POST https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_ID:enable
To send your request, expand one of these options:
If successful, the response body will be empty.
C#
Before trying this sample, follow the C# setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM C# API reference documentation.
Go
Before trying this sample, follow the Go setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Go API reference documentation.
Java
Before trying this sample, follow the Java setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Java API reference documentation.
Python
Before trying this sample, follow the Python setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Python API reference documentation.
Deleting a service account
When you delete a service account, applications will no longer have access to Google Cloud resources through that service account. If you delete the default App Engine and Compute Engine service accounts, the instances will no longer have access to resources in the project.
Delete with caution; make sure your critical applications are no longer using a service account before deleting it. If you're not sure whether a service account is being used, we recommend disabling the service account before deleting it. Disabled service accounts can be easily re-enabled if they are still in use.
When a service account is deleted, its role bindings are not immediately removed; they are automatically purged from the system after a maximum of 60 days.
Deleted service accounts do not count towards your service account quota.
To delete a service account, at minimum the user must be granted the
Service Account Admin role (roles/iam.serviceAccountAdmin
) or the Editor basic
role (roles/editor
).
Console
In the Cloud Console, go to the Service accounts page.
Select a project.
Select the service account you want to delete, and then click Delete
.
gcloud
Execute the gcloud iam service-accounts delete
command to delete a service account.
Command:
gcloud iam service-accounts delete \ sa-name@project-id.iam.gserviceaccount.com
Output:
Deleted service account sa-name@project-id.iam.gserviceaccount.com
REST
The
serviceAccounts.delete
method deletes a service account.
Before using any of the request data below, make the following replacements:
PROJECT_ID
: Your Google Cloud project ID. Project IDs are alphanumeric strings, likemy-project
.SA_ID
: The ID of your service account. This can either be the service account's email address in the formSA_NAME@PROJECT_ID.iam.gserviceaccount.com
, or the service account's unique numeric ID.
HTTP method and URL:
DELETE https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_ID
To send your request, expand one of these options:
If successful, the response body will be empty.
C#
Before trying this sample, follow the C# setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM C# API reference documentation.
Go
Before trying this sample, follow the Go setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Go API reference documentation.
Java
Before trying this sample, follow the Java setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Java API reference documentation.
Python
Before trying this sample, follow the Python setup instructions in the IAM Quickstart Using Client Libraries. For more information, see the IAM Python API reference documentation.
Undeleting a service account
In some cases, you can use the undelete
command to undelete a deleted service
account. You can usually undelete a deleted service account if it meets these
criteria:
The service account was deleted less than 30 days ago.
After 30 days, IAM permanently removes the service account. Google Cloud cannot recover the service account after it is permanently removed, even if you file a support request.
There is no existing service account with the same name as the deleted service account.
For example, suppose that you accidentally delete the service account
my-service-account@project-id.iam.gserviceaccount.com
. You still need a service account with that name, so you create a new service account with the same name,my-service-account@project-id.iam.gserviceaccount.com
.The new service account does not inherit the permissions of the deleted service account. In effect, it is completely separate from the deleted service account. However, you cannot undelete the original service account, because the new service account has the same name.
To address this issue, delete the new service account, then try to undelete the original service account.
If you are not able to undelete the service account, you can create a new service account with the same name; revoke all of the roles from the deleted service account; and grant the same roles to the new service account. For details, see Policies with deleted members.
Finding the service account's numeric ID
When you undelete a service account, you must provide its numeric ID. The
numeric ID is a 21-digit number, such as 123456789012345678901
, that uniquely
identifies the service account. For example, if you delete a service account,
then create a new service account with the same name, the original service
account and the new service account will have different numeric IDs.
If you know that a binding in an IAM policy includes the deleted
service account, you can get the policy, then find the numeric ID
in the policy. The numeric ID is appended to the name of the deleted service
account. For example, in this policy, the numeric ID for the deleted service
account is 123456789012345678901
:
{ "version": 1, "etag": "BwUjMhCsNvY=", "bindings": [ { "members": [ "deleted:serviceAccount:my-service-account@project-id.iam.gserviceaccount.com?uid=123456789012345678901" ], "role": "roles/iam.serviceAccountUser" }, ] }
Alternatively, you can search your audit logs for the DeleteServiceAccount
operation that deleted the service account:
In the Cloud Console, go to the Logs viewer page.
In the search box near the top of the page, click the
expander arrow, then select Convert to advanced filter.In the search box, enter the following query, replacing
service-account-email
with the email address of your service account (for example,my-service-account@project-id.iam.gserviceaccount.com
):resource.type="service_account" resource.labels.email_id="service-account-email" "DeleteServiceAccount"
If the service account was deleted more than an hour ago, select the
Last hour drop-down list, then select a longer period of time.If the service account was deleted more than 7 days ago, select No limit.
Click Submit filter. The Logs Viewer displays the
DeleteServiceAccount
operations that affected service accounts with the name you specified. The numeric ID for each service account appears next to the textDeleteServiceAccount
.If the search results include only one
DeleteServiceAccount
operation, make note of the numeric ID. You will use the numeric ID to undelete the service account.If there is more than one search result, click the
expander arrow next to a search result. Review the details of the log entry, and determine whether the log entry shows the operation that you want to undo. Repeat this process until you find the correct log entry, then make note of the numeric ID in that entry.
Undeleting the service account by numeric ID
After you find the numeric ID for the deleted service account, you can try to undelete the service account.
gcloud
Execute the gcloud beta iam service-accounts undelete
command to undelete a service account.
Command:
gcloud beta iam service-accounts undelete account-id
Output:
restoredAccount: email: sa-name@project-id.iam.gserviceaccount.com etag: BwWWE7zpApg= name: projects/project-id/serviceAccounts/sa-name@project-id.iam.gserviceaccount.com oauth2ClientId: '123456789012345678901' projectId: project-id uniqueId: 'account-id'
REST
The
serviceAccounts.undelete
method restores a deleted service account.
Before using any of the request data below, make the following replacements:
PROJECT_ID
: Your Google Cloud project ID. Project IDs are alphanumeric strings, likemy-project
.SA_NUMERIC_ID
: The unique numeric ID of the service account.
HTTP method and URL:
POST https://iam.googleapis.com/v1/projects/PROJECT_ID/serviceAccounts/SA_NUMERIC_ID:undelete
To send your request, expand one of these options:
If the account can be undeleted, you receive a 200 OK
response
code with details about the restored service account, like the following:
{ "restoredAccount": { "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com", "projectId": "my-project", "uniqueId": "123456789012345678901", "email": "my-service-account@my-project.iam.gserviceaccount.com", "displayName": "My service account", "etag": "BwUp3rVlzes=", "description": "A service account for running jobs in my project", "oauth2ClientId": "987654321098765432109" } }
What's next
- Learn how to create and manage service account keys.
- Review the process for granting IAM roles to all types of members, including service accounts.
- Explore how you can use the IAM recommender to downscope permissions for all members, including service accounts.
- Understand how to allow members to impersonate service accounts.
Try it for yourself
If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
Get started for free