[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-09 (世界標準時間)。"],[],[],null,["# Cloud Workstations service accounts\n\nThis page describes the service accounts created and managed by\nCloud Workstations. Cloud Workstations creates two service\naccounts:\n\n- [Cloud Workstations Service Agent](#workstations-service-agent)\n- [Cloud Workstations VM Default Service Account](#default_service_account)\n\nGoogle owns these accounts, but they are specific to your project. They are\ndeleted only when you delete your project. You might encounter service\ndisruptions if you change the permissions granted to these service accounts.\n\n### Cloud Workstations Service Agent\n\nThe Cloud Workstations Service Agent uses the following email format: \n\n```\nservice-PROJECT_NUMBER@gcp-sa-workstations.iam.gserviceaccount.com\n```\n\nThis service agent allows Cloud Workstations to\nperform service duties on your project. By default, this service agent is\nautomatically granted the Workstations Service Agent (`roles/workstations.serviceAgent`)\nIAM role on your project.\n\nRevoking or changing the permissions for this service agent prevents\nCloud Workstations from accessing the compute and network resources\nthat back your workstations. To avoid service disruptions, don't modify the\nservice agent's permissions.\n\n### Cloud Workstations VM Default Service Account\n\nWorkstations are hosted on Compute Engine instances. When you create a\nworkstation, you can specify a service account to attach to the underlying\nCompute Engine instance. If you don't specify a service account, the\nCloud Workstations VM Default Service Account for your project is used.\n\nThe Cloud Workstations VM Default Service Account uses the following email format: \n\n```\nservice-PROJECT_NUMBER@gcp-sa-workstationsvm.iam.gserviceaccount.com\n```\n\nUsing the Cloud Workstations VM Default Service Account has the\nfollowing limitations:\n\n- [Cloud Workstations container output logging](/workstations/docs/container-output-logging) is not supported.\n- [Impersonating a service account](/workstations/docs/authentication#impersonate-a-service-account) is not supported.\n- You cannot use `ssh` to connect to the VM assigned to the workstations that use this configuration.\n\nTo avoid these limitations, you can specify a service account on your\nworkstation configuration. For more information, see\n[Customize the environment](/workstations/docs/create-configuration#customize_environment).\n\nWhat's next\n-----------\n\n- [Authenticate and setup API access within a workstation](/workstations/docs/authentication).\n- [Access control with IAM](/workstations/docs/access-control)."]]
