Service agents

Some Google Cloud services have Google-managed service accounts that allow the services to access your resources. These service accounts are sometimes known as service agents. You might see evidence of these service agents in several different places, including a project's Identity and Access Management (IAM) policy and audit log entries for various services.

This page provides details about the service agents for all services that are publicly available, including the following:

  • The domain name used in the service agent's email address.
  • The role that the service agent is granted on the project.

    After you activate an API that uses the service agent, Google grants the role automatically.

Google can introduce new service agents at any time, both for existing services and for new services. In addition, the format of each service agent's email address is subject to change.

Display name Domain Role
ASM Mesh Data Plane Service Account gcp-sa-meshdataplane.iam.gserviceaccount.com Mesh Data Plane Service Agent
(roles/meshdataplane.serviceAgent)
Anthos Config Management Service Account gcp-sa-anthosconfigmanagement.iam.gserviceaccount.com Anthos Config Management Service Agent
(roles/anthosconfigmanagement.serviceAgent)
Anthos Service Account gcp-sa-anthos.iam.gserviceaccount.com Anthos Service Agent
(roles/anthos.serviceAgent)
Anthos Service Mesh Service Account gcp-sa-servicemesh.iam.gserviceaccount.com None
Apigee Service Agent gcp-sa-apigee.iam.gserviceaccount.com Apigee Service Agent
(roles/apigee.serviceAgent)
App Engine Flexible Environment Service Agent gae-api-prod.google.com.iam.gserviceaccount.com App Engine flexible environment Service Agent
(roles/appengineflex.serviceAgent)
Artifact Registry Service Agent gcp-sa-artifactregistry.iam.gserviceaccount.com Artifact Registry Service Agent
(roles/artifactregistry.serviceAgent)
AssuredWorkloads Service Account gcp-sa-assuredworkloads.iam.gserviceaccount.com None
AutoML Recommendations Service Account gcp-sa-recommendationengine.iam.gserviceaccount.com Recommendations AI Service Agent
(roles/automlrecommendations.serviceAgent)
AutoML Service Agent gcp-sa-automl.iam.gserviceaccount.com AutoML Service Agent
(roles/automl.serviceAgent)
BigQuery Connection Service Agent gcp-sa-bigqueryconnection.iam.gserviceaccount.com BigQuery Connection Service Agent
(roles/bigqueryconnection.serviceAgent)
BigQuery Data Transfer Service Agent gcp-sa-bigquerydatatransfer.iam.gserviceaccount.com BigQuery Data Transfer Service Agent
(roles/bigquerydatatransfer.serviceAgent)
Binary Authorization Service Agent gcp-sa-binaryauthorization.iam.gserviceaccount.com Binary Authorization Service Agent
(roles/binaryauthorization.serviceAgent)
Cloud AI Platform Notebooks Service Account gcp-sa-notebooks.iam.gserviceaccount.com AI Platform Notebooks Service Agent
(roles/notebooks.serviceAgent)
Cloud API Gateway Management Plane Service Account gcp-sa-apigateway-mgmt.iam.gserviceaccount.com None
Cloud API Gateway Service Account gcp-sa-apigateway.iam.gserviceaccount.com None
Cloud Asset Service Agent gcp-sa-cloudasset.iam.gserviceaccount.com Cloud Asset Service Agent
(roles/cloudasset.serviceAgent)
Cloud Bigtable Service Agent gcp-sa-bigtable.iam.gserviceaccount.com None
Cloud Build Service Account gcp-sa-cloudbuild.iam.gserviceaccount.com Cloud Build Service Agent
(roles/cloudbuild.serviceAgent)
Cloud Composer Service Agent cloudcomposer-accounts.iam.gserviceaccount.com Cloud Composer API Service Agent
(roles/composer.serviceAgent)
Cloud Data Fusion Service Account gcp-sa-datafusion.iam.gserviceaccount.com Cloud Data Fusion API Service Agent
(roles/datafusion.serviceAgent)
Cloud Dataflow Service Account dataflow-service-producer-prod.iam.gserviceaccount.com Cloud Dataflow Service Agent
(roles/dataflow.serviceAgent)
Cloud Endpoints Service Agent gcp-sa-endpoints.iam.gserviceaccount.com Cloud Endpoints Service Agent
(roles/endpoints.serviceAgent)
Cloud File Storage Service Account cloud-filer.iam.gserviceaccount.com Cloud Filestore Service Agent
(roles/file.serviceAgent)
Cloud Healthcare Service Agent gcp-sa-healthcare.iam.gserviceaccount.com Healthcare Service Agent
(roles/healthcare.serviceAgent)
Cloud IoT Core Service Agent gcp-sa-cloudiot.iam.gserviceaccount.com Cloud IoT Core Service Agent
(roles/cloudiot.serviceAgent)
Cloud KMS Service Agent gcp-sa-cloudkms.iam.gserviceaccount.com Cloud KMS Service Agent
(roles/cloudkms.serviceAgent)
Cloud Life Sciences Service Agent gcp-sa-lifesciences.iam.gserviceaccount.com Cloud Life Sciences Service Agent
(roles/lifesciences.serviceAgent)
Cloud Managed Identities Service Agent gcp-sa-mi.iam.gserviceaccount.com Cloud Managed Identities Service Agent
(roles/managedidentities.serviceAgent)
Cloud Memorystore Memcache Service Agent cloud-memcache-sa.iam.gserviceaccount.com Cloud Memorystore Memcached Service Agent
(roles/memcache.serviceAgent)
Cloud Memorystore Redis Service Agent cloud-redis.iam.gserviceaccount.com Cloud Memorystore Redis Service Agent
(roles/redis.serviceAgent)
Cloud Network Management Service Account gcp-sa-networkmanagement.iam.gserviceaccount.com GCP Network Management Service Agent
(roles/networkmanagement.serviceAgent)
Cloud Pub/Sub Service Account gcp-sa-pubsub.iam.gserviceaccount.com None
Cloud SQL Service Account gcp-sa-cloud-sql.iam.gserviceaccount.com Cloud SQL Service Agent
(roles/cloudsql.serviceAgent)
Cloud Scheduler Service Account gcp-sa-cloudscheduler.iam.gserviceaccount.com Cloud Scheduler Service Agent
(roles/cloudscheduler.serviceAgent)
Cloud Security Command Center Notification Service Account gcp-sa-scc-notification.iam.gserviceaccount.com Security Center Notification Service Agent
(roles/securitycenter.notificationServiceAgent)
Cloud Source Repositories Service Agent sourcerepo-service-accounts.iam.gserviceaccount.com Cloud Source Repositories Service Agent
(roles/sourcerepo.serviceAgent)
Cloud Spanner Production Service Account gcp-sa-spanner.iam.gserviceaccount.com None
Cloud Storage for Firebase Service Agent gcp-sa-firebasestorage.iam.gserviceaccount.com Cloud Storage for Firebase Service Agent
(roles/firebasestorage.serviceAgent)
Cloud Tasks Service Account gcp-sa-cloudtasks.iam.gserviceaccount.com Cloud Tasks Service Agent
(roles/cloudtasks.serviceAgent)
Cloud Trace Service Account gcp-sa-cloud-trace.iam.gserviceaccount.com None
Cloud VM Migration Service Account gcp-sa-vmmigration.iam.gserviceaccount.com None
Cloud Web Security Scanner Service Agent gcp-sa-websecurityscanner.iam.gserviceaccount.com Cloud Web Security Scanner Service Agent
(roles/websecurityscanner.serviceAgent)
Cloud Workflows Service Agent gcp-sa-workflows.iam.gserviceaccount.com Cloud Workflows Service Agent
(roles/workflows.serviceAgent)
Compute Engine Service Agent compute-system.iam.gserviceaccount.com Compute Engine Service Agent
(roles/compute.serviceAgent)
Compute Scanning Service Agent gcp-sa-computescanning.iam.gserviceaccount.com Compute Scanning Service Agent
(roles/computescanning.serviceAgent)
Container Analysis Service Agent container-analysis.iam.gserviceaccount.com Container Analysis Service Agent
(roles/containeranalysis.ServiceAgent)
Container Scanning Service Agent gcp-sa-containerscanning.iam.gserviceaccount.com Container Scanner Service Agent
(roles/containerscanning.ServiceAgent)
Container Threat Detection Service Agent gcp-sa-ktd-control.iam.gserviceaccount.com Container Threat Detection Service Agent
(roles/containerthreatdetection.serviceAgent)
Data Labeling Service Account gcp-sa-datalabeling.iam.gserviceaccount.com DataLabeling Service Agent
(roles/datalabeling.serviceAgent)
Data Studio Service Account gcp-sa-datastudio.iam.gserviceaccount.com Data Studio Service Agent
(roles/datastudio.serviceAgent)
Dialogflow Service Agent gcp-sa-dialogflow.iam.gserviceaccount.com Dialogflow Service Agent
(roles/dialogflow.serviceAgent)
DocumentAI Core Service Agent gcp-sa-prod-dai-core.iam.gserviceaccount.com DocumentAI Core Service Agent
(roles/documentaicore.serviceAgent)
Endpoints Consumer Portal Service Agent endpoints-portal.iam.gserviceaccount.com Endpoints Portal Service Agent
(roles/endpointsportal.serviceAgent)
External Key Management Service Service Account gcp-sa-ekms.iam.gserviceaccount.com None
Firebase Extensions Service Agent gcp-sa-firebasemods.iam.gserviceaccount.com Firebase Extensions API Service Agent
(roles/firebasemods.serviceAgent)
Firebase Extensions Service Agent gcp-sa-firebasemods.iam.gserviceaccount.com Firebase Extensions API Service Agent
(roles/firebasemods.serviceAgent)
Firebase Rules Service Agent firebase-rules.iam.gserviceaccount.com None
Firewall Insights Service Account gcp-sa-firewallinsights.iam.gserviceaccount.com Cloud Firewall Insights Service Agent
(roles/firewallinsights.serviceAgent)
GKE Hub API Service Account gcp-sa-gkehub.iam.gserviceaccount.com GKE Hub Service Agent
(roles/gkehub.serviceAgent)
Game Services Agent gcp-sa-gameservices.iam.gserviceaccount.com Game Services Service Agent
(roles/gameservices.serviceAgent)
Google Cloud Dataproc Service Agent dataproc-accounts.iam.gserviceaccount.com Dataproc Service Agent
(roles/dataproc.serviceAgent)
Google Cloud Functions Service Agent gcf-admin-robot.iam.gserviceaccount.com Cloud Functions Service Agent
(roles/cloudfunctions.serviceAgent)
Google Cloud ML Engine Service Agent cloud-ml.google.com.iam.gserviceaccount.com Cloud ML Service Agent
(roles/ml.serviceAgent)
Google Cloud OS Config Service Agent gcp-sa-osconfig.iam.gserviceaccount.com Cloud OS Config Service Agent
(roles/osconfig.serviceAgent)
Google Cloud Run Service Agent serverless-robot-prod.iam.gserviceaccount.com Cloud Run Service Agent
(roles/run.serviceAgent)
Google Container Registry Service Agent containerregistry.iam.gserviceaccount.com Container Registry Service Agent
(roles/containerregistry.ServiceAgent)
Google Genomics Service Agent genomics-api.google.com.iam.gserviceaccount.com Genomics Service Agent
(roles/genomics.serviceAgent)
Kubernetes Engine Service Agent container-engine-robot.iam.gserviceaccount.com Kubernetes Engine Service Agent
(roles/container.serviceAgent)
Mesh Config Service Account gcp-sa-meshconfig.iam.gserviceaccount.com Mesh Config Service Agent
(roles/meshconfig.serviceAgent)
Monitoring Notification Service Account gcp-sa-monitoring-notification.iam.gserviceaccount.com Monitoring Notification Service Agent
(roles/monitoring.notificationServiceAgent)
Multi Cluster Ingress Service Account gcp-sa-multiclusteringress.iam.gserviceaccount.com Multi Cluster Ingress Service Agent
(roles/multiclusteringress.serviceAgent)
Multi cluster metering Service Account gcp-sa-mcmetering.iam.gserviceaccount.com Multi-cluster metering Service Agent
(roles/multiclustermetering.serviceAgent)
Private CA Service Account gcp-sa-privateca.iam.gserviceaccount.com None
Remote Build Execution Service Agent gcp-sa-rbe.iam.gserviceaccount.com None
Remote Build Execution Service Agent remotebuildexecution.iam.gserviceaccount.com Remote Build Execution Service Agent
(roles/remotebuildexecution.serviceAgent)
Secret Manager Service Account gcp-sa-secretmanager.iam.gserviceaccount.com None
Serverless VPC Access Service Agent gcp-sa-vpcaccess.iam.gserviceaccount.com Serverless VPC Access Service Agent
(roles/vpcaccess.serviceAgent)
Service Consumer Management Service Agent service-consumer-management.iam.gserviceaccount.com None
Service Networking Service Agent service-networking.iam.gserviceaccount.com Service Networking Service Agent
(roles/servicenetworking.serviceAgent)
TPU Service Agent cloud-tpu.iam.gserviceaccount.com Cloud TPU API Service Agent
(roles/tpu.serviceAgent)
TPU Service Agent (v2) gcp-sa-tpu.iam.gserviceaccount.com Cloud TPU V2 API Service Agent
(roles/cloudtpu.serviceAgent)