āļŦāļāđāļēāļāļĩāđāļāļāļīāļāļēāļĒāļ§āļīāļāļĩāļŠāļĢāđāļēāļāđāļĨāļ°āļāļąāļāļāļēāļĢāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļāļĒāđāļāđ Identity and Access Management (IAM) API, Google Cloud Console āđāļĨāļ° āļāļģāļŠāļąāđāļ gcloud- āđāļāļĢāļ·āđāļāļāļĄāļ·āļāļāļĢāļĢāļāļąāļ āļāļēāļĄāļāđāļēāđāļĢāļīāđāļĄāļāđāļ āđāļāđāļĨāļ°āđāļāļĢāļāļāļēāļĢāļŠāļēāļĄāļēāļĢāļāļĄāļĩāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļāđāļŠāļđāļāļŠāļļāļ 100 āļāļąāļāļāļĩāļāļĩāđāļāļ§āļāļāļļāļĄāļāļēāļĢāđāļāđāļēāļāļķāļāļāļĢāļąāļāļĒāļēāļāļĢāļāļāļāļāļļāļ āļāļļāļāļŠāļēāļĄāļēāļĢāļāļāļāđāļāļīāđāļĄāđāļāļ§āļāđāļēāđāļāđāļŦāļēāļāļāļģāđāļāđāļ āđāļĢāļĩāļĒāļāļĢāļđāđāđāļāļīāđāļĄāđāļāļīāļĄāđāļāļĩāđāļĒāļ§āļāļąāļāđāļāļ§āļāđāļēāđāļĨāļ°āļāļĩāļāļāļģāļāļąāļ ## āļāđāļāļāļāļĩāđāļāļ°āđāļĢāļīāđāļĄ āđāļāļīāļāđāļāđāļāļēāļ IAM API āļāļģāļāļ§āļēāļĄāđāļāđāļēāđāļāļāļąāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ IAM āļāļīāļāļāļąāđāļ Google Cloud CLI āļāļāļāļēāļāļāļĩāđāļāļģāđāļāđāļ āļŦāļēāļāļāđāļāļāļāļēāļĢāļĢāļąāļāļŠāļīāļāļāļīāđāļāļĩāđāļāļģāđāļāđāļāđāļāļāļēāļĢāļāļąāļāļāļēāļĢāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āđāļāļĢāļāļāļāđāļŦāđāļāļđāđāļāļđāđāļĨāļĢāļ°āļāļāļĄāļāļāļāļāļāļēāļ IAM āļāđāļāđāļāļāļĩāđāđāļŦāđāļāļąāļāļāļļāļāđāļāđāļāļĢāđāļāđāļāļāđ: - āļŦāļēāļāļāđāļāļāļāļēāļĢāļāļđāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļĨāļ°āļāđāļāļĄāļđāļĨāđāļĄāļāļēāļāļāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ: āļāļđāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ ( āļāļāļāļēāļ/iam.serviceAccountViewer) - āļŦāļēāļāļāđāļāļāļāļēāļĢāļāļđāđāļĨāļ°āļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ: āļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ ( āļāļāļāļēāļ/iam.serviceAccountCreator) - āļŦāļēāļāļāđāļāļāļāļēāļĢāļāļđāđāļĨāļ°āļĨāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ: āļĨāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ ( āļāļāļāļēāļ/iam.serviceAccountDeleter) - āđāļāļāļēāļĢāļāļąāļāļāļēāļĢ (āļāļđ āļŠāļĢāđāļēāļ āļāļąāļāđāļāļ āļāļīāļāđāļāđāļāļēāļ āđāļāļīāļāđāļāđ āļĨāļ āļĒāļāđāļĨāļīāļāļāļēāļĢāļĨāļ āđāļĨāļ°āļāļąāļāļāļēāļĢāļāļēāļĢāđāļāđāļēāļāļķāļ) āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļĒāđāļēāļāļŠāļĄāļāļđāļĢāļāđ: āļāļđāđāļāļđāđāļĨāļĢāļ°āļāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ ( āļāļāļāļēāļ/iam.serviceAccountAdmin) āļŠāļģāļŦāļĢāļąāļāļāđāļāļĄāļđāļĨāđāļāļīāđāļĄāđāļāļīāļĄāđāļāļĩāđāļĒāļ§āļāļąāļāļāļēāļĢāđāļŦāđāļŠāļīāļāļāļīāđāļāļāļāļēāļ āļāļđāļāļąāļāļāļēāļĢāļāļēāļĢāđāļāđāļēāļāļķāļ āļŦāļēāļāļāđāļāļāļāļēāļĢāđāļĢāļĩāļĒāļāļĢāļđāđāđāļāļīāđāļĄāđāļāļīāļĄāđāļāļĩāđāļĒāļ§āļāļąāļāļāļāļāļēāļāđāļŦāļĨāđāļēāļāļĩāđ āđāļāļĢāļāļāļđāļāļāļāļēāļāļāļāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āļāļāļāļēāļāļāļ·āđāļāļāļēāļāļāļāļ IAM āļĒāļąāļāļāļĢāļ°āļāļāļāļāđāļ§āļĒāļŠāļīāļāļāļīāđāđāļāļāļēāļĢāļāļąāļāļāļēāļĢāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āļāļļāļāđāļĄāđāļāļ§āļĢāđāļŦāđāļŠāļīāļāļāļīāđāļāļāļāļēāļāļāļ·āđāļāļāļēāļāđāļāļŠāļ āļēāļāđāļ§āļāļĨāđāļāļĄāļāļēāļĢāđāļāđāļāļēāļāļāļĢāļīāļ āđāļāđāļāļļāļāļŠāļēāļĄāļēāļĢāļāđāļŦāđāļŠāļīāļāļāļīāđāđāļāđāđāļāļŠāļ āļēāļāđāļ§āļāļĨāđāļāļĄāļāļēāļĢāļāļąāļāļāļēāļŦāļĢāļ·āļāļāļēāļĢāļāļāļŠāļāļ ## āļāļēāļĢāļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āđāļĄāļ·āđāļāļāļļāļāļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āļāļļāļāļāđāļāļāļĢāļ°āļāļļāļĢāļŦāļąāļŠāļāļĩāđāđāļāđāļāļāļąāļ§āļāļąāļāļĐāļĢāđāļĨāļ°āļāļąāļ§āđāļĨāļāļāļĨāļ°āļāļąāļ ( āđāļāļāļąāļ§āļāļĒāđāļēāļāļāđāļēāļāļĨāđāļēāļ) āđāļāđāļ `SA_NAME` āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļāļāļāļąāļ ID āļāđāļāļāļĄāļĩāļāļ§āļēāļĄāļĒāļēāļ§āļĢāļ°āļŦāļ§āđāļēāļ 6 āļāļķāļ 30 āļāļąāļ§āļāļąāļāļĐāļĢ āđāļĨāļ°āļŠāļēāļĄāļēāļĢāļ āļĄāļĩāļāļąāļāļāļĢāļ°āļāļĩāđāđāļāđāļāļāļąāļ§āļāļąāļāļĐāļĢāļāļīāļĄāļāđāđāļĨāđāļāđāļĨāļ°āļāļąāļ§āđāļĨāļāļāļĨāļ°āļāļąāļāđāļĨāļ°āļāļĩāļāļāļĨāļēāļ āļŦāļĨāļąāļāļāļēāļāļāļĩāđāļāļļāļāļŠāļĢāđāļēāļāļāļĢāļīāļāļēāļĢ āļāļąāļāļāļĩāļāļļāļāđāļĄāđāļŠāļēāļĄāļēāļĢāļāđāļāļĨāļĩāđāļĒāļāļāļ·āđāļāđāļāđ āļāļ·āđāļāļāļāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļĢāļēāļāļāđāļāļāļĩāđāļāļĒāļđāđāļāļĩāđāļĄāļĨāļāļĩāđāļāļąāļāđāļāļĢāļĩāļĒāļĄāđāļ§āđ āļĢāļ°āļŦāļ§āđāļēāļāļāļēāļĢāļŠāļĢāđāļēāļāđāļāļĢāļđāļāđāļāļ `SA_NAME`@ `PROJECT_ID`.iam.gserviceaccount.com āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļāđāļĨāļ°āļāļąāļāļāļĩāļĒāļąāļāļĄāļĩ ID āļāļąāļ§āđāļĨāļāļāļĩāđāđāļĄāđāļāđāļģāđāļāļāļāļēāļ§āļĢ āļāļķāđāļāļŠāļĢāđāļēāļāļāļķāđāļāđāļāļĒāļāļąāļāđāļāļĄāļąāļāļī āļāļļāļāļĒāļąāļāļĢāļ°āļāļļāļāđāļāļĄāļđāļĨāļāđāļāđāļāļāļĩāđāđāļĄāļ·āđāļāļāļļāļāļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ: āđāļāđāļāļāļģāļāļāļīāļāļēāļĒāļāļĩāđāđāļĄāđāļāļąāļāļāļąāļāļŠāļģāļŦāļĢāļąāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ SA_DESCRIPTION āđāļāđāļāļāļ·āđāļāļāļĩāđāđāļĢāļĩāļĒāļāļāđāļēāļĒāļŠāļģāļŦāļĢāļąāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ SA_DISPLAY_NAME āļāļ·āļ ID āļāļāļāđāļāļĢāļāļāļēāļĢ Google Cloud āļāļāļāļāļļāļ PROJECT_ID āļŦāļĨāļąāļāļāļēāļāļāļĩāđāļāļļāļāļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āļāļļāļāļāļēāļāļāđāļāļāļĢāļāļāļĒāđāļēāļāļāđāļāļĒ 60 āļ§āļīāļāļēāļāļĩāļāđāļāļāļāļĩāđāļāļ°āđāļāđāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āļĨāļąāļāļĐāļāļ°āļāļēāļĢāļāļģāļāļēāļāļāļĩāđāđāļāļīāļāļāļķāđāļāđāļāļ·āđāļāļāļāļēāļāļāļēāļĢāļāļģāđāļāļīāļāļāļēāļĢāļāđāļēāļāļāļ°āļŠāļāļāļāļĨāđāļāļāļāļąāļāđāļāļāļĩāđāļŠāļļāļ āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļŦāļĄāđāļāļēāļāļāđāļāļāđāļāđāđāļ§āļĨāļēāļāļķāļāļāļ°āļĄāļāļāđāļŦāđāļāđāļāđ āļŦāļēāļāļāļļāļāļāļĒāļēāļĒāļēāļĄāļāđāļēāļāļŦāļĢāļ·āļāđāļāđāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļąāļāļāļĩāļŦāļĨāļąāļāļāļēāļāļāļĩāđāļāļļāļāļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļąāđāļ āđāļĨāļ°āļāļļāļāđāļāđāļĢāļąāļāļāđāļāļāļīāļāļāļĨāļēāļ āļāļļāļāļŠāļēāļĄāļēāļĢāļāļĨāļāļāļāļģāļāļāļāļĩāļāļāļĢāļąāđāļāđāļāļĒāđāļāđāļāļēāļĢāļāļāļĒāļāļĨāļąāļāđāļāļāđāļāđāļāļāđāđāļāđāļāļāđāļāļĩāļĒāļĨ āļāļāļāđāļāļĨ āđāļāļāļāļāđāļāļĨ Google Cloud āđāļŦāđāđāļāļāļĩāđ āļŠāļĢāđāļēāļāļŦāļāđāļēāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āđāļāļāļĩāđāļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āđāļĨāļ·āļāļāđāļāļĢāļāļāļēāļĢāļāļĨāļēāļ§āļāđ āļāđāļāļāļāļ·āđāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļĩāđāļāļ°āđāļŠāļāļāđāļ Google Cloud Console Google Cloud Console āļŠāļĢāđāļēāļāļĢāļŦāļąāļŠāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļēāļĄāļāļ·āđāļāļāļĩāđ āđāļāđāđāļ ID āļŦāļēāļāļāļģāđāļāđāļ āļāļļāļāđāļĄāđāļŠāļēāļĄāļēāļĢāļāđāļāļĨāļĩāđāļĒāļ ID āđāļāđāđāļāļ āļēāļĒāļŦāļĨāļąāļ āđāļĄāđāļāļąāļāļāļąāļ: āļāđāļāļāļāļģāļāļāļīāļāļēāļĒāļāļāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āļŦāļēāļāļāļļāļāđāļĄāđāļāđāļāļāļāļēāļĢāļāļąāđāļāļāđāļēāļāļēāļĢāļāļ§āļāļāļļāļĄāļāļēāļĢāđāļāđāļēāļāļķāļāļāļāļāļāļĩāđ āđāļŦāđāļāļĨāļīāļ āđāļŠāļĢāđāļāļŠāļīāđāļāđāļāļ·āđāļāļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļŦāđāđāļŠāļĢāđāļāļŠāļīāđāļ āļŦāļēāļāļāđāļāļāļāļēāļĢāļāļąāđāļāļāđāļēāļāļēāļĢāļāļ§āļāļāļļāļĄāļāļēāļĢāđāļāđāļēāļāļķāļāļāļāļāļāļĩāđ āđāļŦāđāļāļĨāļīāļ āļŠāļĢāđāļēāļāđāļĨāļ°āļāļģāđāļāļīāļāļāļēāļĢāļāđāļāđāļĨāļ°āļāļģāđāļāļīāļāļāļēāļĢāļāđāļāđāļāļĒāļąāļāļāļąāđāļāļāļāļāļāļąāļāđāļ āđāļĄāđāļāļąāļāļāļąāļ: āđāļĨāļ·āļāļāļāļāļāļēāļ IAM āļāļĒāđāļēāļāļāđāļāļĒāļŦāļāļķāđāļāļĢāļēāļĒāļāļēāļĢāđāļāļ·āđāļāļĄāļāļāđāļŦāđāļāļąāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļāđāļāļĢāļāļāļēāļĢ āđāļĄāļ·āđāļāļāļļāļāđāļāļīāđāļĄāļāļāļāļēāļāđāļŠāļĢāđāļāđāļĨāđāļ§ āđāļŦāđāļāļĨāļīāļ āļāļģāđāļāļīāļāļāļēāļĢāļāđāļ āļāļēāļāđāļĨāļ·āļāļ: āđāļ āļāđāļāļāļāļāļāļēāļāļāļāļāļāļđāđāđāļāđāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āđāļāļīāđāļĄāļŠāļĄāļēāļāļīāļāļāļĩāđāļŠāļēāļĄāļēāļĢāļāđāļĨāļĩāļĒāļāđāļāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļāđ āļāļēāļāđāļĨāļ·āļāļ: āđāļ āļāļāļāļēāļāļāļāļāļāļđāđāļāļđāđāļĨāļĢāļ°āļāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āđāļāļīāđāļĄāļŠāļĄāļēāļāļīāļāļāļĩāđāļŠāļēāļĄāļēāļĢāļāļāļąāļāļāļēāļĢāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļāđ āļāļĨāļīāļ āđāļŠāļĢāđāļāļŠāļīāđāļāđāļāļ·āđāļāļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļŦāđāđāļŠāļĢāđāļāļŠāļīāđāļ gcloud CLI āļŦāļēāļāļāđāļāļāļāļēāļĢāļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āđāļŦāđāđāļĢāļĩāļĒāļāđāļāđ āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ gcloud iam createcommand: āļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ gcloud iam SA_NAME\ --description="DESCRIPTION"\ --display-name="DISPLAY_NAME"āđāļāļāļāļĩāđāļāđāļēāļāđāļāđāļāļāļĩāđ: : āļāļ·āđāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ SA_NAME : āļāļģāļāļāļīāļāļēāļĒāļāļĩāđāđāļĄāđāļāļąāļāļāļąāļāļāļāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āļāļģāļāļāļīāļāļēāļĒ : āļāļ·āđāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļĩāđāļāļ°āđāļŠāļāļāđāļ Google Cloud Console āļāļ·āđāļāļāļĩāđāđāļŠāļāļ - āđāļĄāđāļāļąāļāļāļąāļ: āđāļāļāļēāļĢāđāļŦāđāļŠāļīāļāļāļīāđāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļāļāļāļļāļāļāļąāļāļāļāļāļēāļ IAM āđāļāđāļāļĢāļāļāļēāļĢāļāļāļāļāļļāļ āđāļŦāđāđāļĢāļĩāļĒāļāđāļāđ āđāļāļĢāļāļāļēāļĢ gcloud add-iam-policy-bindingcommand: gcloud āđāļāļĢāđāļāđāļāļāđ add-iam-policy-binding PROJECT_ID\ --member="serviceAccount: SA_NAME@ PROJECT_ID.iam.gserviceaccount.com"\ --role="ROLE_NAME"āđāļāļāļāļĩāđāļāđāļēāļāđāļāđāļāļāļĩāđ: : āļĢāļŦāļąāļŠāđāļāļĢāļāļāļēāļĢ PROJECT_ID : āļāļ·āđāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ SA_NAME : āļāļ·āđāļāļāļāļāļēāļ āđāļāđāļ ROLE_NAME āļāļāļāļēāļ/compute.osāđāļāđāļēāļŠāļđāđāļĢāļ°āļāļ - āđāļĄāđāļāļąāļāļāļąāļ: āļŦāļēāļāļāđāļāļāļāļēāļĢāļāļāļļāļāļēāļāđāļŦāđāļāļđāđāđāļāđāļāļĨāļāļĄāđāļāļĨāļāđāļāđāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āđāļŦāđāđāļĢāļĩāļĒāļāđāļāđ gcloud iam service-accounts add-iam-policy-bindingcommand āđāļāļ·āđāļāļĄāļāļāļāļāļāļēāļāļāļđāđāđāļāđāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļāđāļāļđāđāđāļāđ ( roles/iam.serviceAccountUser) āđāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ: āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ gcloud iam add-iam-policy-binding SA_NAME@ PROJECT_ID.iam.gserviceaccount.com \ --member="user: USER_EMAIL"\ --role="roles/iam.serviceAccountUser"āđāļāļāļāļĩāđāļāđāļēāļāđāļāđāļāļāļĩāđ: : āļĢāļŦāļąāļŠāđāļāļĢāļāļāļēāļĢ PROJECT_ID : āļāļ·āđāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ SA_NAME : āļāļĩāđāļāļĒāļđāđāļāļĩāđāļĄāļĨāļŠāļģāļŦāļĢāļąāļāļāļđāđāđāļāđ USER_EMAIL - āļāļąāļāļāđāļāļ āđāļāļāļ° serviceAccounts.create āļ§āļīāļāļĩāļāļēāļĢāļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āļāđāļāļāđāļāđāļāđāļāļĄāļđāļĨāļāļģāļāļāđāļāđ āđāļŦāđāļāļģāđāļāļīāļāļāļēāļĢāđāļāļāļāļĩāđāļāļąāļāļāđāļāđāļāļāļĩāđ: : āļĢāļŦāļąāļŠāđāļāļĢāļāļāļēāļĢ Google Cloud āļāļāļāļāļļāļ āļĢāļŦāļąāļŠāđāļāļĢāļāļāļēāļĢāļāļ·āļāļŠāļāļĢāļīāļāļāļĩāđāđāļāđāļāļāļąāļ§āļāļąāļāļĐāļĢāđāļĨāļ°āļāļąāļ§āđāļĨāļāļāļĨāļ°āļāļąāļ āđāļāđāļ PROJECT_ID āđāļāļĢāļāļāļēāļĢāļāļāļāļāļąāļ : ID āļāļąāļ§āļāļąāļāļĐāļĢāđāļĨāļ°āļāļąāļ§āđāļĨāļāļāļāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļāļāļāļļāļ āļāļ·āđāļāļāļĩāđāļāđāļāļāļĄāļĩāļāļ§āļēāļĄāļĒāļēāļ§āļĢāļ°āļŦāļ§āđāļēāļ 6 āļāļķāļ 30 āļāļąāļāļāļĢāļ° āđāļĨāļ°āļŠāļēāļĄāļēāļĢāļāļĄāļĩāļāļąāļāļāļĢāļ°āļāļĩāđāđāļāđāļāļāļąāļ§āļāļąāļāļĐāļĢāļāļīāļĄāļāđāđāļĨāđāļāđāļĨāļ°āļāļąāļ§āđāļĨāļāļāļĨāļ°āļāļąāļāđāļĨāļ°āļāļĩāļāļāļĨāļēāļāđāļāđ SA_NAME : āđāļĄāđāļāļģāđāļāđāļ. āļāļģāļāļāļīāļāļēāļĒāļŠāļģāļŦāļĢāļąāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ SA_DESCRIPTION : āļāļ·āđāļāļāļĩāđāļĄāļāļļāļĐāļĒāđāļŠāļēāļĄāļēāļĢāļāļāđāļēāļāđāļāđāļŠāļģāļŦāļĢāļąāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ SA_DISPLAY_NAME āļ§āļīāļāļĩāļāļēāļĢ HTTP āđāļĨāļ° URL: āđāļāļŠāļāđ httpsiam.googleapis.com/v1/projects/ PROJECT_ID/āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āļāļāđāļāļ·āđāļāļāļ§āļēāļĄ JSON: { "āļŦāļĄāļēāļĒāđāļĨāļāļāļąāļāļāļĩ": "SA_NAME", "serviceAccount": { "description": "SA_DESCRIPTION", "displayName": "SA_DISPLAY_NAME"} } āļŦāļēāļāļāđāļāļāļāļēāļĢāļŠāđāļāļāļģāļāļ āđāļŦāđāļāļĒāļēāļĒāļāļąāļ§āđāļĨāļ·āļāļāđāļāļāļąāļ§āđāļĨāļ·āļāļāļŦāļāļķāđāļāļāđāļāđāļāļāļĩāđ āļāļ (Linux, macOS āļŦāļĢāļ·āļ Cloud Shell) āļāļąāļāļāļķāļāđāļāļ·āđāļāļŦāļēāļāļģāļāļāđāļāđāļāļĨāđāļāļĩāđāđāļĢāļĩāļĒāļāļ§āđāļē āļāļģāļāļ json āđāļĨāļ°āļĢāļąāļāļāļģāļŠāļąāđāļāļāđāļāđāļāļāļĩāđ: curl -X POST -H "āļāļēāļĢāļāļāļļāļāļēāļ: Bearer $(gcloud auth print-access-token)"-H "āļāļĢāļ°āđāļ āļāđāļāļ·āđāļāļŦāļē: application/json; charset=utf-8"-d @request.json "httpsiam.googleapis.com /v1/āđāļāļĢāļāļāļēāļĢ/ PROJECT_ID/āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ"āļāļēāļ§āđāļ§āļāļĢāđāđāļāļĨāļĨāđ (āļ§āļīāļāđāļāļ§āļŠāđ) āļāļąāļāļāļķāļāđāļāļ·āđāļāļŦāļēāļāļģāļāļāđāļāđāļāļĨāđāļāļĩāđāđāļĢāļĩāļĒāļāļ§āđāļē āļāļģāļāļ json āđāļĨāļ°āļĢāļąāļāļāļģāļŠāļąāđāļāļāđāļāđāļāļāļĩāđ: $cred = gcloud āļĢāļąāļāļĢāļāļāđāļāđāļāđāļāļāļēāļĢāđāļāđāļēāļāļķāļāļāļēāļĢāļāļīāļĄāļāđ $headers = @{ "Authorization"= "Bearer $cred"} āđāļĢāļĩāļĒāļāđāļāđ WebRequest ` - āļ§āļīāļāļĩāļāļēāļĢāđāļāļŠāļāđ ` -Headers $āđāļŪāļāđāļāļāļĢāđ ` -ContentType: "application/json; charset=utf-8"` -InFile request.json ` -Uri "httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts"| āđāļĨāļ·āļāļāļ§āļąāļāļāļļ - āļāļĒāļēāļĒāđāļāļ·āđāļāļŦāļē API Explorer (āđāļāļĢāļēāļ§āđāđāļāļāļĢāđ) āļāļąāļāļĨāļāļāđāļāļ·āđāļāļŦāļēāļāļģāļāļāđāļĨāļ°āđāļāļīāļāđāļāļĨāđ āļŦāļāđāļēāļāđāļēāļāļāļīāļāļ§āļīāļāļĩāļāļēāļĢ āđāļāļ API Explorer āļāļ°āđāļāļīāļāļāļķāđāļāļāļēāļāļāđāļēāļāļāļ§āļēāļāļāļāļŦāļāđāļē āļāļļāļāļŠāļēāļĄāļēāļĢāļāđāļāđāļāļāļāļāļąāļāđāļāļĢāļ·āđāļāļāļĄāļ·āļāļāļĩāđāđāļāļ·āđāļāļŠāđāļāļāļģāļāļ āļ§āļēāļāđāļāļ·āđāļāļŦāļēāļāļģāļāļāđāļāđāļāļĢāļ·āđāļāļāļĄāļ·āļāļāļĩāđ āļāļĢāļāļāļāđāļāļĄāļđāļĨāđāļāļāļīāļĨāļāđāļāļĩāđāļāļģāđāļāđāļāļāļ·āđāļāđ āđāļĨāđāļ§āļāļĨāļīāļ **āļāļģāđāļāļīāļāļāļēāļĢ** āļāļļāļāļāļ§āļĢāđāļāđāļĢāļąāļāļāļēāļĢāļāļāļāļŠāļāļāļ JSON āļāļĨāđāļēāļĒāļāļąāļāļāđāļāđāļāļāļĩāđ: { "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com", "projectId": "my-project", "uniqueId": "123456789012345678901", "email": "my-service-account@my-project.iam.gserviceaccount.com", "displayName": "āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļāļāļāļąāļ", "etag": "BwUp3rVlzes "description": "āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļŠāļģāļŦāļĢāļąāļāļāļēāļĢāđāļĢāļĩāļĒāļāđāļāđāļāļēāļāđāļāļāļāļāļāļąāļ āđāļāļĢāļāļāļēāļĢ", "oauth2ClientId": "987654321098765432109"} āļ āļēāļĐāļēāļāļĩ++ āļŦāļēāļāļāđāļāļāļāļēāļĢāđāļĢāļĩāļĒāļāļĢāļđāđāļ§āļīāļāļĩāļāļīāļāļāļąāđāļāđāļĨāļ°āđāļāđāđāļĨāļāļĢāļēāļĢāļĩāđāļāļĨāđāļāđāļāļāđāļŠāļģāļŦāļĢāļąāļ IAM āđāļāļĢāļāļāļđāđāļĨāļāļĢāļēāļĢāļĩāđāļāļĨāđāļāđāļāļāđ IAM āļŠāļģāļŦāļĢāļąāļāļāđāļāļĄāļđāļĨāđāļāļīāđāļĄāđāļāļīāļĄ āđāļāļĢāļāļāļđāđāļāļāļŠāļēāļĢāļāđāļēāļāļāļīāļ IAM C++ API āđāļāļĄāļŠāđāļāļ iam = ::google::cloud::iam; std::string const& project_id, std::string const& account_id, std::string const& display_name, std::string const& āļāļģāļāļāļīāļāļēāļĒ) { iam::IAMClient āļĨāļđāļāļāđāļē(iam::MakeIAMConnection google::iam::admin::v1::ServiceAccount service_account; service_account.set_display_name(display_name); service_account.set_description(description); auto response = client.CreateServiceAccount("projects/ "+ project_id, account_id, service_account); āļāđāļē (!response) āļŠāđāļ std::runtime_error(response.statusmessage std::cout<< "āļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļŠāļģāđāļĢāđāļāđāļĨāđāļ§: "<< āļāļēāļĢāļāļāļāļŠāļāļāļ->DebugString()<< ""; } āļ# āļŦāļēāļāļāđāļāļāļāļēāļĢāđāļĢāļĩāļĒāļāļĢāļđāđāļ§āļīāļāļĩāļāļīāļāļāļąāđāļāđāļĨāļ°āđāļāđāđāļĨāļāļĢāļēāļĢāļĩāđāļāļĨāđāļāđāļāļāđāļŠāļģāļŦāļĢāļąāļ IAM āđāļāļĢāļāļāļđāđāļĨāļāļĢāļēāļĢāļĩāđāļāļĨāđāļāđāļāļāđ IAM āļŠāļģāļŦāļĢāļąāļāļāđāļāļĄāļđāļĨāđāļāļīāđāļĄāđāļāļīāļĄ āđāļāļĢāļāļāļđāđāļāļāļŠāļēāļĢāļāđāļēāļāļāļīāļ IAM C# API āđāļāđāļĢāļ°āļāļ; āđāļāđ Google.Apis.Auth.OAuth2; āđāļāđ Google.Apis.Iam.v1; āđāļāđ Google.Apis.Iam.v1.Data; ServiceAccounts āļāļĨāļēāļŠāļāļēāļāļŠāđāļ§āļāļŠāļēāļāļēāļĢāļāļ° { ServiceAccount CreateServiceAccount āđāļāļāļāļāļāļĩāđāļŠāļēāļāļēāļĢāļāļ° (āļĢāļŦāļąāļŠāđāļāļĢāļāļāļēāļĢāļŠāļāļĢāļīāļ, āļāļ·āđāļāļŠāļāļĢāļīāļ, āļāļ·āđāļāļŠāļāļĢāļīāļāļāļĩāđāđāļŠāļāļ) { var credential = GoogleCredential.GetApplicationDefault() .CreateScoped (IamService.Scope.CloudPlatform); var service = new IamService(new IamService.Initializer { HttpClientInitializer = credentialvar request = new CreateServiceAccountRequest { AccountId = name, ServiceAccount = new ServiceAccount { DisplayName = displayName } }; var serviceAccount = service.Projects.ServiceAccounts.Create( āļāļģāļāļ "āđāļāļĢāļāļāļēāļĢ/ "+ projectId).Execute Console.WriteLine("āļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ: "+ serviceAccount.Email); return serviceAccount; } } āđāļ āļŦāļēāļāļāđāļāļāļāļēāļĢāđāļĢāļĩāļĒāļāļĢāļđāđāļ§āļīāļāļĩāļāļīāļāļāļąāđāļāđāļĨāļ°āđāļāđāđāļĨāļāļĢāļēāļĢāļĩāđāļāļĨāđāļāđāļāļāđāļŠāļģāļŦāļĢāļąāļ IAM āđāļāļĢāļāļāļđāđāļĨāļāļĢāļēāļĢāļĩāđāļāļĨāđāļāđāļāļāđ IAM āļŠāļģāļŦāļĢāļąāļāļāđāļāļĄāļđāļĨāđāļāļīāđāļĄāđāļāļīāļĄ āđāļāļĢāļāļāļđāđāļāļāļŠāļēāļĢāļāđāļēāļāļāļīāļ IAM Go API āļāļģāđāļāđāļē ( "āļāļĢāļīāļāļ""fmt""io"iam "google.golang.org/api/iam/v1") // createServiceAccount āļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ func createServiceAccount(w io.Writer, projectID, name, displayName string) (*iam.ServiceAccount, error) { ctx := context.Background() service, err := iam.NewService(ctx) if err != nil { return nil, fmt.Errorf("iam.NewService: %v", err) } request :=&iam.CreateServiceAccountRequest{ AccountId: āļāļ·āđāļ, ServiceAccount:&iam.ServiceAccount{ DisplayName: displayName, }, } āļāļąāļāļāļĩ err := service.Projects.ServiceAccounts.Create("projectsprojectID, request).Do() if err != nil { return nil, fmt.Errorf("Projects.ServiceAccounts.Create: %v", err) } fmt.Fprintf(w, "āļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ: %v", āļāļąāļāļāļĩ) āļāļ·āļāļāļąāļāļāļĩ āđāļĄāđāļĄāļĩ } āļāļ§āļē āļŦāļēāļāļāđāļāļāļāļēāļĢāđāļĢāļĩāļĒāļāļĢāļđāđāļ§āļīāļāļĩāļāļīāļāļāļąāđāļāđāļĨāļ°āđāļāđāđāļĨāļāļĢāļēāļĢāļĩāđāļāļĨāđāļāđāļāļāđāļŠāļģāļŦāļĢāļąāļ IAM āđāļāļĢāļāļāļđāđāļĨāļāļĢāļēāļĢāļĩāđāļāļĨāđāļāđāļāļāđ IAM āļŠāļģāļŦāļĢāļąāļāļāđāļāļĄāļđāļĨāđāļāļīāđāļĄāđāļāļīāļĄ āđāļāļĢāļāļāļđāđāļāļāļŠāļēāļĢāļāđāļēāļāļāļīāļ IAM Java API āļāļģāđāļāđāļē com.google.api.client.googleapis.javanet.GoogleNetHttpTransport; āļāļģāđāļāđāļē com.google.api.client.json.jackson2.JacksonFactory; āļāļģāđāļāđāļē com.google.api.services.iam.v1.Iam; āļāļģāđāļāđāļē com.google.api.services.iam.v1.IamScopes; āļāļģāđāļāđāļē com.google.api.services.iam.v1.model.CreateServiceAccountRequest; āļāļģāđāļāđāļē com.google.api.services.iam.v1.model.ServiceAccount; āļāļģāđāļāđāļē com.google.auth.http.HttpCredentialsAdapter; āļāļģāđāļāđāļē com.google.auth.oauth2.GoogleCredentials; āļāļģāđāļāđāļē java.io.IOException; āļāļģāđāļāđāļē java.security.GeneralSecurityException; āļāļģāđāļāđāļē java.util.Collections; CreateServiceAccount āļāļĨāļēāļŠāļŠāļēāļāļēāļĢāļāļ° { // āļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āđāļĄāļāļ°āļŠāļēāļāļēāļĢāļāļ°āļāļāļāļĩāđ createServiceAccount (String projectId, String serviceAccountName) { // String projectId = "my-project-id"; // āļŠāļāļĢāļīāļ serviceAccountName = "āļāļ·āđāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļāļāļāļąāļ"; āļāļĢāļīāļāļēāļĢāđāļāļĩāđāļĒāļĄ = null; āļĨāļāļ { service = initService } catch (IOException | GeneralSecurityException e) { System.out.println("āđāļĄāđāļŠāļēāļĄāļēāļĢāļāđāļĢāļīāđāļĄāļāđāļāļāļĢāļīāļāļēāļĢ: "+ e.toString return; } āļĨāļāļ { ServiceAccount serviceAccount = new ServiceAccount serviceAccount.setDisplayName("your-display-name CreateServiceAccountRequest request = new CreateServiceAccountRequest request.setAccountId(serviceAccountName); request.setServiceAccount(serviceAccount); serviceAccount = service.projectsserviceAccountscreate( "projects/"+ projectId, request).execute System.out.println("āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļĩāđāļŠāļĢāđāļēāļ: "+ serviceAccount.getEmail } catch (IOException e) { System.out.println("āđāļĄāđāļŠāļēāļĄāļēāļĢāļāļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ: "+ e.toString } } āļŠāđāļ§āļāļāļąāļ§āļāļ Iam initService() āļŠāđāļ GeneralSecurityException, IOException { // āđāļāđāļāļĨāļĒāļļāļāļāđāļāđāļāļĄāļđāļĨāļĢāļąāļāļĢāļāļāđāļĢāļīāđāļĄāļāđāļāļāļāļāđāļāļāļāļĨāļīāđāļāļāļąāļāļŠāļģāļŦāļĢāļąāļāļāļēāļĢāļāļĢāļ§āļāļŠāļāļāļŠāļīāļāļāļīāđ āļŠāļģāļŦāļĢāļąāļāļāđāļāļĄāļđāļĨāđāļāļīāđāļĄāđāļāļīāļĄ āđāļāļĢāļāļāļđāļāļĩāđ: // httpscloud.google.com/docs/authentication/production#finding_credentials_automatically āļāđāļāļĄāļđāļĨāļĢāļąāļāļĢāļāļ GoogleCredentials = GoogleCredentials.getApplicationDefault() .createScoped(Collections.singleton(IamScopes.CLOUD_PLATFORM // āđāļĢāļīāđāļĄāļāđāļāļāļĢāļīāļāļēāļĢ IAM āļāļķāđāļāļŠāļēāļĄāļēāļĢāļāđāļāđāđāļāļ·āđāļāļŠāđāļāļāļģāļāļāđāļāļĒāļąāļ IAM API āļāļĢāļīāļāļēāļĢ Iam = Iam.Builder āđāļŦāļĄāđ ( GoogleNetHttpTransport.newTrustedTransport JacksonFactory getDefaultInstance āđāļŦāļĄāđ HttpCredentialsAdapter(āļāđāļāļĄāļđāļĨāļĢāļąāļāļĢāļāļ)) .setApplicationName("āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ") .build āļāļĢāļīāļāļēāļĢāļŠāđāļāļāļ·āļ } } āļŦāļĨāļēāļĄ āļŦāļēāļāļāđāļāļāļāļēāļĢāđāļĢāļĩāļĒāļāļĢāļđāđāļ§āļīāļāļĩāļāļīāļāļāļąāđāļāđāļĨāļ°āđāļāđāđāļĨāļāļĢāļēāļĢāļĩāđāļāļĨāđāļāđāļāļāđāļŠāļģāļŦāļĢāļąāļ IAM āđāļāļĢāļāļāļđāđāļĨāļāļĢāļēāļĢāļĩāđāļāļĨāđāļāđāļāļāđ IAM āļŠāļģāļŦāļĢāļąāļāļāđāļāļĄāļđāļĨāđāļāļīāđāļĄāđāļāļīāļĄ āđāļāļĢāļāļāļđāđāļāļāļŠāļēāļĢāļāđāļēāļāļāļīāļ IAM Python API āļāļģāđāļāđāļēāļĢāļ°āļāļāļāļāļīāļāļąāļāļīāļāļēāļĢāļāļēāļ google.oauth2 āļāļģāđāļāđāļē service_account āļāļģāđāļāđāļē googleapiclient.discovery def create_service_account(project_id, name, display_name): āļŠāļĢāđāļēāļāļāđāļāļĄāļđāļĨāļāļĢāļ°āļāļģāļāļąāļ§āļāļāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ = service_account.Credentials.from_service_account_file( filename=os.environ['GOOGLE_APPLICATION_CREDENTIALS scopeshttpswww.googleapis.com/auth/ āļāļĢāļīāļāļēāļĢāđāļāļĨāļāļāļāļĢāđāļĄāļāļĨāļēāļ§āļāđ = googleapiclient.discovery.build( 'iam', 'v1', credentials=credentials) my_service_account = service.projectsserviceAccountscreate( name='projects/'+ project_id, body={ 'accountId': name, 'serviceAccount': { 'displayName': display_name } execute() print('āļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ: '+ my_service_account['email return my_service_account āļŦāļĨāļąāļāļāļēāļāļāļĩāđāļāļļāļāļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļĨāđāļ§ āđāļŦāđāļĄāļāļāļāļāļāļēāļāļāļĒāđāļēāļāļāđāļāļĒāļŦāļāļķāđāļāļāļāļāļēāļāđāļŦāđāļāļąāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļāļ·āđāļāđāļŦāđāļāļģāđāļāļīāļāļāļēāļĢāđāļāļāļēāļĄāļāļāļāļāļļāļāđāļāđ āļāļāļāļāļēāļāļāļĩāđ āļŦāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļģāđāļāđāļāļāđāļāļāđāļāđāļēāļāļķāļāļāļĢāļąāļāļĒāļēāļāļĢāđāļāđāļāļĢāļāļāļēāļĢāļāļ·āđāļāđ āđāļāļĒāļāļāļāļīāđāļĨāđāļ§ āļāļļāļāļāđāļāļāđāļāļīāļāđāļāđ API āļŠāļģāļŦāļĢāļąāļāļāļĢāļąāļāļĒāļēāļāļĢāđāļŦāļĨāđāļēāļāļąāđāļāđāļāđāļāļĢāļāļāļēāļĢāļāļĩāđāļāļļāļāļŠāļĢāđāļēāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ ## āļĢāļēāļĒāļāļ·āđāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āļāļļāļāļŠāļēāļĄāļēāļĢāļāđāļŠāļāļāļĢāļēāļĒāļāļēāļĢāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļāļāļāļļāļāđāļāļ·āđāļāļāđāļ§āļĒāļāļļāļāļāļĢāļ§āļāļŠāļāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļĨāļ°āļāļĩāļĒāđ āļŦāļĢāļ·āļāđāļāđāļāļŠāđāļ§āļāļŦāļāļķāđāļāļāļāļāđāļāļĢāļ·āđāļāļāļĄāļ·āļāļāļĩāđāļāļģāļŦāļāļāđāļāļāļŠāļģāļŦāļĢāļąāļāļāļąāļāļāļēāļĢāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āļāļāļāđāļāļĨ āđāļāļāļāļāđāļāļĨ Google Cloud āđāļŦāđāđāļāļāļĩāđ āļŦāļāđāļēāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āđāļĨāļ·āļāļāđāļāļĢāļāļāļēāļĢ āđāļāļāļ° āļŦāļāđāļēāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļŠāļāļāļĢāļēāļĒāļāļēāļĢāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļĩāđāļāļąāļāļāļēāļĢāđāļāļĒāļāļđāđāđāļāđāļāļąāđāļāļŦāļĄāļāđāļāđāļāļĢāļāļāļēāļĢāļāļĩāđāļāļļāļāđāļĨāļ·āļāļ āļŦāļāđāļēāļāļĩāđāđāļĄāđāļĄāļĩāļĢāļēāļĒāļāļēāļĢāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļĩāđāļāļąāļāļāļēāļĢāđāļāļĒ Google gcloud CLI āļāļģāđāļāļīāļāļāļēāļĢ āļĢāļēāļĒāļāļēāļĢāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ gcloud iam āļāļģāļŠāļąāđāļāđāļāļ·āđāļāđāļŠāļāļāļĢāļēāļĒāļāļēāļĢāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļąāđāļāļŦāļĄāļāđāļāđāļāļĢāļāļāļēāļĢ āļŠāļąāđāļāļāļēāļĢ: āļĢāļēāļĒāļāļēāļĢāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ gcloud iam āļāļĨāļĨāļąāļāļāđāļāļ·āļāļĢāļēāļĒāļāļēāļĢāļāļāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļąāđāļāļŦāļĄāļāđāļāđāļāļĢāļāļāļēāļĢ: āļāļ·āđāļ āļāļĩāđāļĄāļĨ SA_DISPLAY_NAME_1 SA_NAME_1@ PROJECT_ID.iam.gserviceaccount.com SA_DISPLAY_NAME_2 SA_NAME_2@ PROJECT_ID.iam.gserviceaccount.com āļāļąāļāļāđāļāļ āđāļāļāļ° serviceAccounts.list āđāļĄāļāļāļāđāļŠāļāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļąāđāļāļŦāļĄāļāđāļāđāļāļĢāļāļāļēāļĢāļāļāļāļāļļāļ āļāđāļāļāđāļāđāļāđāļāļĄāļđāļĨāļāļģāļāļāđāļāđ āđāļŦāđāļāļģāđāļāļīāļāļāļēāļĢāđāļāļāļāļĩāđāļāļąāļāļāđāļāđāļāļāļĩāđ: : āļĢāļŦāļąāļŠāđāļāļĢāļāļāļēāļĢ Google Cloud āļāļāļāļāļļāļ āļĢāļŦāļąāļŠāđāļāļĢāļāļāļēāļĢāļāļ·āļāļŠāļāļĢāļīāļāļāļĩāđāđāļāđāļāļāļąāļ§āļāļąāļāļĐāļĢāđāļĨāļ°āļāļąāļ§āđāļĨāļāļāļĨāļ°āļāļąāļ āđāļāđāļ PROJECT_ID āđāļāļĢāļāļāļēāļĢāļāļāļāļāļąāļ āļ§āļīāļāļĩāļāļēāļĢ HTTP āđāļĨāļ° URL: āļĢāļąāļ httpsiam.googleapis.com/v1/projects/ PROJECT_ID/āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ āļŦāļēāļāļāđāļāļāļāļēāļĢāļŠāđāļāļāļģāļāļ āđāļŦāđāļāļĒāļēāļĒāļāļąāļ§āđāļĨāļ·āļāļāđāļāļāļąāļ§āđāļĨāļ·āļāļāļŦāļāļķāđāļāļāđāļāđāļāļāļĩāđ āļāļ (Linux, macOS āļŦāļĢāļ·āļ Cloud Shell) āļāļģāđāļāļīāļāļāļēāļĢāļāļģāļŠāļąāđāļāļāđāļāđāļāļāļĩāđ: curl -X GET -H "āļāļēāļĢāļāļāļļāļāļēāļ: Bearer $(gcloud auth print-access-token)""httpsiam.googleapis.com/v1/projects/ PROJECT_ID/āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ"āļāļēāļ§āđāļ§āļāļĢāđāđāļāļĨāļĨāđ (āļ§āļīāļāđāļāļ§āļŠāđ) āļāļģāđāļāļīāļāļāļēāļĢāļāļģāļŠāļąāđāļāļāđāļāđāļāļāļĩāđ: $cred = gcloud āļĢāļąāļāļĢāļāļāđāļāđāļāđāļāļāļēāļĢāđāļāđāļēāļāļķāļāļāļēāļĢāļāļīāļĄāļāđ $headers = @{ "Authorization"= "Bearer $cred"} āđāļĢāļĩāļĒāļāđāļāđ WebRequest ` -āđāļĄāļāļāļ GET ` -Headers $āđāļŪāļāđāļāļāļĢāđ ` -Uri "httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts"| āđāļĨāļ·āļāļāļ§āļąāļāļāļļ - āļāļĒāļēāļĒāđāļāļ·āđāļāļŦāļē API Explorer (āđāļāļĢāļēāļ§āđāđāļāļāļĢāđ) āđāļāļīāļ āļŦāļāđāļēāļāđāļēāļāļāļīāļāļ§āļīāļāļĩāļāļēāļĢ āđāļāļ API Explorer āļāļ°āđāļāļīāļāļāļķāđāļāļāļēāļāļāđāļēāļāļāļ§āļēāļāļāļāļŦāļāđāļē āļāļļāļāļŠāļēāļĄāļēāļĢāļāđāļāđāļāļāļāļāļąāļāđāļāļĢāļ·āđāļāļāļĄāļ·āļāļāļĩāđāđāļāļ·āđāļāļŠāđāļāļāļģāļāļ āļāļĢāļāļāļāđāļāļĄāļđāļĨāđāļāļāļīāļĨāļāđāļāļĩāđāļāļģāđāļāđāļāđāļĨāļ°āļāļĨāļīāļ **āļāļģāđāļāļīāļāļāļēāļĢ** āļāļļāļāļāļ§āļĢāđāļāđāļĢāļąāļāļāļēāļĢāļāļāļāļŠāļāļāļ JSON āļāļĨāđāļēāļĒāļāļąāļāļāđāļāđāļāļāļĩāđ: { "āļāļąāļāļāļĩ": [ { "āļāļ·āđāļ": "projects/my-project/serviceAccounts/sa-1@my-project.iam.gserviceaccount.com", "projectId": "my-project", "uniqueId": "123456789012345678901", "email": "sa-1@my-project.iam.gserviceaccount.com", "description": "āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļĢāļāļāļāļāļāļąāļ", "displayName": "āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ 1", "etag": "BwUpTsLVUkQ "oauth2ClientId": "987654321098765432109"}, { "name": "projects/my-project/serviceAccounts/sa-2@my-project.iam.gserviceaccount.com", "projectId": "my-project", "uniqueId ": "234567890123456789012", "email": "sa-2@my-project.iam.gserviceaccount.com", "description": "āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāļāļĩāđāļŠāļāļāļāļāļāļāļąāļ", "displayName": "āļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢ 2", "etag": "UkQpTwBVUsL "oauth2ClientId": "876543210987654321098"} ] } āļ āļēāļĐāļēāļāļĩ++ āļŦāļēāļāļāđāļāļāļāļēāļĢāđāļĢāļĩāļĒāļāļĢāļđāđāļ§āļīāļāļĩāļāļīāļāļāļąāđāļāđāļĨāļ°āđāļāđāđāļĨāļāļĢāļēāļĢāļĩāđāļāļĨāđāļāđāļāļāđāļŠāļģāļŦāļĢāļąāļ IAM āđāļāļĢāļāļāļđāđāļĨāļāļĢāļēāļĢāļĩāđāļāļĨāđāļāđāļāļāđ IAM āļŠāļģāļŦāļĢāļąāļāļāđāļāļĄāļđāļĨāđāļāļīāđāļĄāđāļāļīāļĄ āđāļāļĢāļāļāļđāđāļāļāļŠāļēāļĢāļāđāļēāļāļāļīāļ IAM C++ API āđāļāļĄāļŠāđāļāļ iam = ::google::cloud::iam; std::āļŠāļāļĢāļīāļ const& project_id) { iam::IAMClient client(iam::MakeIAMConnection int count = 0; for (auto const& sa : client.ListServiceAccounts("projects/"+ project_id)) { āļāđāļē (!sa) āđāļĒāļ std::runtime_error(sa.statusmessage std::cout<< "āļāļķāļāļāđāļāļĄāļđāļĨ ServiceAccount āļŠāļģāđāļĢāđāļāđāļĨāđāļ§: "<< sa->name()<< ""; ++count; } if (count == 0) { std::cout<< "āđāļĄāđāļāļāļāļąāļāļāļĩāļāļĢāļīāļāļēāļĢāđāļāđāļāļĢāļāļāļēāļĢ: "<< project_id<< ""; } } āļ# āļŦāļēāļāļāđāļāļāļāļēāļĢāđāļĢāļĩāļĒāļāļĢāļđāđāļ§āļīāļāļĩāļāļīāļāļāļąāđāļāđāļĨāļ°āđāļāđāđāļĨāļāļĢāļēāļĢāļĩāđāļāļĨāđāļāđāļāļāđāļŠāļģāļŦāļĢāļąāļ IAM āđāļāļĢāļāļāļđāđāļĨāļāļĢāļēāļĢāļĩāđāļāļĨāđāļāđāļāļāđ IAM āļŠāļģāļŦāļĢāļąāļāļāđāļāļĄāļđāļĨāđāļāļīāđāļĄāđāļāļīāļĄ āđāļāļĢāļāļāļđāđāļāļāļŠāļēāļĢāļāđāļēāļāļāļīāļ IAM C# API āđāļāđāļĢāļ°āļāļ; āđāļāđ System.Collections.Generic; āđāļāđ Google.Apis.Auth.OAuth2; āđāļāđ Google.Apis.Iam.v1; āđāļāđ Google.Apis.Iam.v1.Data; ServiceAccounts āļāļĨāļēāļŠāļŠāļēāļāļēāļĢāļāļ°āļāļēāļāļŠāđāļ§āļ { āļŠāļēāļāļēāļĢāļāļ°āļāļāļāļĩāđ IListListServiceAccounts(string projectId) { var credential = GoogleCredential.GetApplicationDefault() .CreateScoped(IamService.Scope.CloudPlatform); var service = new IamService(new IamService.Initializer { HttpClientInitializer = credentialvar response = service.Projects.ServiceAccounts.List( "projects/" + projectId).Execute foreach (ServiceAccount account in response.Accounts) { Console.WriteLine("Name: " + account.Name); Console.WriteLine("Display Name: " + account.DisplayName); Console.WriteLine("Email: " + account.Email); Console.WriteLine } return response.Accounts; } } Go To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Go API reference documentation import ( "context" "fmt" "io" iam "google.golang.org/api/iam/v1" ) // listServiceAccounts lists a project's service accounts. func listServiceAccounts(w io.Writer, projectID string) iam.ServiceAccount, error) { ctx := context.Background() service, err := iam.NewService(ctx) if err != nil { return nil, fmt.Errorf("iam.NewService: %v", err) } response, err := service.Projects.ServiceAccounts.List("projects/" + projectID).Do() if err != nil { return nil, fmt.Errorf("Projects.ServiceAccounts.List: %v", err) } for _, account := range response.Accounts { fmt.Fprintf(w, "Listing service account: %v ", account.Name) } return response.Accounts, nil } Java To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Java API reference documentation import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport; import com.google.api.client.json.jackson2.JacksonFactory; import com.google.api.services.iam.v1.Iam; import com.google.api.services.iam.v1.IamScopes; import com.google.api.services.iam.v1.model.ListServiceAccountsResponse; import com.google.api.services.iam.v1.model.ServiceAccount; import com.google.auth.http.HttpCredentialsAdapter; import com.google.auth.oauth2.GoogleCredentials; import java.io.IOException; import java.security.GeneralSecurityException; import java.util.Collections; import java.util.List; public class ListServiceAccounts { // Lists all service accounts for the current project. public static void listServiceAccounts(String projectId) { // String projectId = "my-project-id" Iam service = null; try { service = initService } catch (IOException | GeneralSecurityException e) { System.out.println("Unable to initialize service: " + e.toString return; } try { ListServiceAccountsResponse response = service.projectsserviceAccountslist("projects/" + projectId).execute List serviceAccounts = response.getAccounts for (ServiceAccount account : serviceAccounts) { System.out.println("Name: " + account.getName System.out.println("Display Name: " + account.getDisplayName System.out.println("Email: " + account.getEmail System.out.println } } catch (IOException e) { System.out.println("Unable to list service accounts: " + e.toString } } private static Iam initService() throws GeneralSecurityException, IOException { // Use the Application Default Credentials strategy for authentication. For more info, see: // httpscloud.google.com/docs/authentication/production#finding_credentials_automatically GoogleCredentials credential = GoogleCredentials.getApplicationDefault() .createScoped(Collections.singleton(IamScopes.CLOUD_PLATFORM // Initialize the IAM service, which can be used to send requests to the IAM API. Iam service = new Iam.Builder( GoogleNetHttpTransport.newTrustedTransport JacksonFactory.getDefaultInstance new HttpCredentialsAdapter(credential)) .setApplicationName("service-accounts") .build return service; } } Python To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Python API reference documentation import os from google.oauth2 import service_account import googleapiclient.discovery def list_service_accounts(project_id): Lists all service accounts for the current project credentials = service_account.Credentials.from_service_account_file( filename=os.environ['GOOGLE_APPLICATION_CREDENTIALS scopeshttpswww.googleapis.com/auth/cloud-platform service = googleapiclient.discovery.build( 'iam', 'v1', credentials=credentials) service_accounts = service.projectsserviceAccountslist( name='projects/' + project_id).execute() for account in service_accounts['accounts print('Name: ' + account['name print('Email: ' + account['email print(' ') return service_accounts ## Updating a service account The display name (friendly name) and description of a service account are commonly used to capture additional information about the service account, such as the purpose of the service account or a contact person for the account Console In the Google Cloud console, go to the Service accountspage Select a project Click the email address of the service account that you want to rename Enter the new name in the Namebox, then click Save gcloud CLI Execute the gcloud iam service-accounts update command to update a service account Command: gcloud iam service-accounts update SA_NAME@ PROJECT_ID.iam.gserviceaccount.com \ --description=" UPDATED_SA_DESCRIPTION" \ --display-name=" UPDATED_DISPLAY_NAME" The output is the renamed service account: description: UPDATED_SA_DESCRIPTIONdisplayName: UPDATED_DISPLAY_NAMEname: projects/ PROJECT_ID/serviceAccounts/ SA_NAME@ PROJECT_ID.iam.gserviceaccount.com REST The serviceAccounts.patch method updates a service account Before using any of the request data, make the following replacements: : Your Google Cloud project ID. Project IDs are alphanumeric strings, like PROJECT_ID my-project : The ID of your service account. This can either be the service account's email address in the form SA_ID , or the service account's unique numeric ID SA_NAME@ PROJECT_ID.iam.gserviceaccount.com : The alphanumeric ID of your service account. This name must be between 6 and 30 characters, and can contain lowercase alphanumeric characters and dashes SA_NAME - Replace at least one of the following: : A new display name for your service account UPDATED_DISPLAY_NAME : A new description for your service account UPDATED_DESCRIPTION HTTP method and URL: PATCH httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts/ SA_ID Request JSON body: { "serviceAccount": { "email": " SA_NAME@ PROJECT_ID.iam.gserviceaccount.com", "displayName": " UPDATED_DISPLAY_NAME", "description": " UPDATED_DESCRIPTION" }, "updateMask": "displayName,description" } To send your request, expand one of these options: curl (Linux, macOS, or Cloud Shell) Save the request body in a file called request.json, and execute the following command: curl -X PATCH -H "Authorization: Bearer $(gcloud auth print-access-token)" -H "Content-Type: application/json; charset=utf-8" -d @request.json "httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts/ SA_ID" PowerShell (Windows) Save the request body in a file called request.json, and execute the following command: $cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method PATCH ` -Headers $headers ` -ContentType: "application/json; charset=utf-8" ` -InFile request.json ` -Uri "httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts/ SA_ID" | Select-Object -Expand Content API Explorer (browser) Copy the request body and open the method reference page The API Explorer panel opens on the right side of the page You can interact with this tool to send requests Paste the request body in this tool, complete any other required fields, and click **Execute** You should receive a JSON response similar to the following: { "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com", "displayName": "My updated service account", "description": "An updated description of my service account" } C++ To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM C++ API reference documentation namespace iam = ::google::cloud::iam; std::string const& name, std::string const& display_name) { iam::IAMClient client(iam::MakeIAMConnection google::iam::admin::v1::PatchServiceAccountRequest request; google::iam::admin::v1::ServiceAccount service_account; service_account.set_name(name); service_account.set_display_name(display_name); google::protobuf::FieldMask update_mask; *update_mask.add_paths() = "display_name"; *request.mutable_service_account() = service_account; *request.mutable_update_mask() = update_mask; auto response = client.PatchServiceAccount(request); if (!response) throw std::runtime_error(response.statusmessage std::cout << "ServiceAccount successfully updated: " << response->DebugString() << " "; } C# To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM C# API reference documentation using System; using Google.Apis.Auth.OAuth2; using Google.Apis.Iam.v1; using Google.Apis.Iam.v1.Data; public partial class ServiceAccounts { public static ServiceAccount RenameServiceAccount(string email, string newDisplayName) { var credential = GoogleCredential.GetApplicationDefault() .CreateScoped(IamService.Scope.CloudPlatform); var service = new IamService(new IamService.Initializer { HttpClientInitializer = credential// First, get a ServiceAccount using List() or Get string resource = "projectsserviceAccounts/" + email; var serviceAccount = service.Projects.ServiceAccounts.Get(resource) .Execute // Then you can update the display name. serviceAccount.DisplayName = newDisplayName; serviceAccount = service.Projects.ServiceAccounts.Update( serviceAccount, resource).Execute Console.WriteLineUpdated display name for {serviceAccount.Email} " + "to: " + serviceAccount.DisplayName); return serviceAccount; } } Go To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Go API reference documentation import ( "context" "fmt" "io" iam "google.golang.org/api/iam/v1" ) // renameServiceAccount renames a service account. func renameServiceAccount(w io.Writer, email, newDisplayName string) (*iam.ServiceAccount, error) { ctx := context.Background() service, err := iam.NewService(ctx) if err != nil { return nil, fmt.Errorf("iam.NewService: %v", err) } // First, get a ServiceAccount using List() or Get resource := "projectsserviceAccounts/" + email serviceAccount, err := service.Projects.ServiceAccounts.Get(resource).Do() if err != nil { return nil, fmt.Errorf("Projects.ServiceAccounts.Get: %v", err) } // Then you can update the display name. serviceAccount.DisplayName = newDisplayName serviceAccount, err = service.Projects.ServiceAccounts.Update(resource, serviceAccount).Do() if err != nil { return nil, fmt.Errorf("Projects.ServiceAccounts.Update: %v", err) } fmt.Fprintf(w, "Updated service account: %v", serviceAccount.Email) return serviceAccount, nil } Java To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Java API reference documentation import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport; import com.google.api.client.json.jackson2.JacksonFactory; import com.google.api.services.iam.v1.Iam; import com.google.api.services.iam.v1.IamScopes; import com.google.api.services.iam.v1.model.ServiceAccount; import com.google.auth.http.HttpCredentialsAdapter; import com.google.auth.oauth2.GoogleCredentials; import java.io.IOException; import java.security.GeneralSecurityException; import java.util.Collections; public class RenameServiceAccount { // Changes a service account's display name. public static void renameServiceAccount(String projectId, String serviceAccountName) { // String projectId = "my-project-id"; // String serviceAccountName = "my-service-account-name"; Iam service = null; try { service = initService } catch (IOException | GeneralSecurityException e) { System.out.println("Unable to initialize service: " + e.toString return; } String serviceAccountEmail = serviceAccountName ++ projectId + ".iam.gserviceaccount.com"; try { // First, get a service account using List() or Get() ServiceAccount serviceAccount = service .projects() .serviceAccounts() .get("projectsserviceAccounts/" + serviceAccountEmail) .execute // Then you can update the display name serviceAccount.setDisplayName("your-new-display-name serviceAccount = service .projects() .serviceAccounts() .update(serviceAccount.getName serviceAccount) .execute System.out.println( "Updated display name for " + serviceAccount.getName() + " to: " + serviceAccount.getDisplayName } catch (IOException e) { System.out.println("Unable to rename service account: " + e.toString } } private static Iam initService() throws GeneralSecurityException, IOException { // Use the Application Default Credentials strategy for authentication. For more info, see: // httpscloud.google.com/docs/authentication/production#finding_credentials_automatically GoogleCredentials credential = GoogleCredentials.getApplicationDefault() .createScoped(Collections.singleton(IamScopes.CLOUD_PLATFORM // Initialize the IAM service, which can be used to send requests to the IAM API. Iam service = new Iam.Builder( GoogleNetHttpTransport.newTrustedTransport JacksonFactory.getDefaultInstance new HttpCredentialsAdapter(credential)) .setApplicationName("service-accounts") .build return service; } } Python To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Python API reference documentation import os from google.oauth2 import service_account import googleapiclient.discovery def rename_service_account(email, new_display_name): Changes a service account's display name # First, get a service account using List() or Get() credentials = service_account.Credentials.from_service_account_file( filename=os.environ['GOOGLE_APPLICATION_CREDENTIALS scopeshttpswww.googleapis.com/auth/cloud-platform service = googleapiclient.discovery.build( 'iam', 'v1', credentials=credentials) resource = 'projectsserviceAccounts/' + email my_service_account = service.projectsserviceAccountsget( name=resource).execute() # Then you can update the display name my_service_account['displayName'] = new_display_name my_service_account = service.projectsserviceAccountsupdate( name=resource, body=my_service_account).execute() print('Updated display name for {} to: format( my_service_account['email my_service_account['displayName return my_service_account ## Disabling a service account Similar to deleting a service account, when you disable a service account, applications will no longer have access to Google Cloud resources through that service account. If you disable the default App Engine and Compute Engine service accounts, the instances will no longer have access to resources in the project. If you attempt to disable an already disabled service account, it will have no effect Unlike deleting a service account, disabled service accounts can easily be re-enabled as necessary. We recommend disabling a service account before deleting it to make sure no critical applications are using the service account Console In the Google Cloud console, go to the Service accountspage Select a project Click the name of the service account that you want to disable Under Service account status, click Disable service account, then click Disableto confirm the change gcloud CLI Execute the gcloud iam service-accounts disable command to disable a service account Command: gcloud iam service-accounts disable SA_NAME@ PROJECT_ID.iam.gserviceaccount.com Output: Disabled service account SA_NAME@ PROJECT_ID.iam.gserviceaccount.com REST The serviceAccounts.disable method immediately disables a service account Before using any of the request data, make the following replacements: : Your Google Cloud project ID. Project IDs are alphanumeric strings, like PROJECT_ID my-project : The ID of your service account. This can either be the service account's email address in the form SA_ID , or the service account's unique numeric ID SA_NAME@ PROJECT_ID.iam.gserviceaccount.com HTTP method and URL: POST httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts/ SA_ID:disable To send your request, expand one of these options: curl (Linux, macOS, or Cloud Shell) Execute the following command: curl -X POST -H "Authorization: Bearer $(gcloud auth print-access-token)" -H "Content-Type: application/json; charset=utf-8" -d "" "httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts/ SA_ID:disable" PowerShell (Windows) Execute the following command: $cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method POST ` -Headers $headers ` -Uri "httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts/ SA_ID:disable" | Select-Object -Expand Content API Explorer (browser) Open the method reference page The API Explorer panel opens on the right side of the page You can interact with this tool to send requests Complete any required fields and click **Execute** If successful, the response body will be empty C++ To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM C++ API reference documentation namespace iam = ::google::cloud::iam; std::string const& name) { iam::IAMClient client(iam::MakeIAMConnection google::iam::admin::v1::DisableServiceAccountRequest request; request.set_name(name); auto response = client.DisableServiceAccount(request); if (!response.ok throw std::runtime_error(response.message std::cout << "ServiceAccount successfully disabled. "; } C# To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM C# API reference documentation using System; using Google.Apis.Auth.OAuth2; using Google.Apis.Iam.v1; using Google.Apis.Iam.v1.Data; public partial class ServiceAccounts { public static void DisableServiceAccount(string email) { var credential = GoogleCredential.GetApplicationDefault() .CreateScoped(IamService.Scope.CloudPlatform); var service = new IamService(new IamService.Initializer { HttpClientInitializer = credentialvar request = new DisableServiceAccountRequest string resource = "projectsserviceAccounts/" + email; service.Projects.ServiceAccounts.Disable(request, resource).Execute Console.WriteLine("Disabled service account: " + email); } } Go To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Go API reference documentation import ( "context" "fmt" "io" iam "google.golang.org/api/iam/v1" ) // disableServiceAccount disables a service account. func disableServiceAccount(w io.Writer, email string) error { // email:= service-account@your-project.iam.gserviceaccount.com ctx := context.Background() service, err := iam.NewService(ctx) if err != nil { return fmt.Errorf("iam.NewService: %v", err) } request := &iam.DisableServiceAccountRequest{} _, err = service.Projects.ServiceAccounts.Disable("projectsserviceAccountsemail, request).Do() if err != nil { return fmt.Errorf("Projects.ServiceAccounts.Disable: %v", err) } fmt.Fprintf(w, "Disabled service account: %v", email) return nil } Java To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Java API reference documentation import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport; import com.google.api.client.json.jackson2.JacksonFactory; import com.google.api.services.iam.v1.Iam; import com.google.api.services.iam.v1.IamScopes; import com.google.api.services.iam.v1.model.DisableServiceAccountRequest; import com.google.auth.http.HttpCredentialsAdapter; import com.google.auth.oauth2.GoogleCredentials; import java.io.IOException; import java.security.GeneralSecurityException; import java.util.Collections; public class DisableServiceAccount { // Disables a service account. public static void disableServiceAccount(String projectId, String serviceAccountName) { // String projectId = "my-project-id"; // String serviceAccountName = "my-service-account-name"; Iam service = null; try { service = initService } catch (IOException | GeneralSecurityException e) { System.out.println("Unable to initialize service: " + e.toString return; } String serviceAccountEmail = serviceAccountName ++ projectId + ".iam.gserviceaccount.com"; try { DisableServiceAccountRequest request = new DisableServiceAccountRequest service .projects() .serviceAccounts() .disable("projectsserviceAccounts/" + serviceAccountEmail, request) .execute System.out.println("Disabled service account: " + serviceAccountEmail); } catch (IOException e) { System.out.println("Unable to disable service account: " + e.toString } } private static Iam initService() throws GeneralSecurityException, IOException { // Use the Application Default Credentials strategy for authentication. For more info, see: // httpscloud.google.com/docs/authentication/production#finding_credentials_automatically GoogleCredentials credential = GoogleCredentials.getApplicationDefault() .createScoped(Collections.singleton(IamScopes.CLOUD_PLATFORM // Initialize the IAM service, which can be used to send requests to the IAM API. Iam service = new Iam.Builder( GoogleNetHttpTransport.newTrustedTransport JacksonFactory.getDefaultInstance new HttpCredentialsAdapter(credential)) .setApplicationName("service-accounts") .build return service; } } Python To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Python API reference documentation import os from google.oauth2 import service_account import googleapiclient.discovery def disable_service_account(email): Disables a service account credentials = service_account.Credentials.from_service_account_file( filename=os.environ['GOOGLE_APPLICATION_CREDENTIALS scopeshttpswww.googleapis.com/auth/cloud-platform service = googleapiclient.discovery.build( 'iam', 'v1', credentials=credentials) service.projectsserviceAccountsdisable( name='projectsserviceAccounts/' + email).execute() print("Disabled service account :" + email) ## Enabling a service account After enabling a disabled service account, applications will regain access to Google Cloud resources through that service account You can enable a disabled service account whenever you need to. If you attempt to enable an already enabled service account, it will have no effect Console In the Google Cloud console, go to the Service accountspage Select a project Click the name of the service account that you want to enable Under Service account status, click Enable service account, then click Enableto confirm the change gcloud CLI Execute the gcloud iam service-accounts enable command to enable a service account Command: gcloud iam service-accounts enable SA_NAME@ PROJECT_ID.iam.gserviceaccount.com Output: Enabled service account SA_NAME@ PROJECT_ID.iam.gserviceaccount.com REST The serviceAccounts.enable method enables a previously disabled service account Before using any of the request data, make the following replacements: : Your Google Cloud project ID. Project IDs are alphanumeric strings, like PROJECT_ID my-project : The ID of your service account. This can either be the service account's email address in the form SA_ID , or the service account's unique numeric ID SA_NAME@ PROJECT_ID.iam.gserviceaccount.com HTTP method and URL: POST httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts/ SA_ID:enable To send your request, expand one of these options: curl (Linux, macOS, or Cloud Shell) Execute the following command: curl -X POST -H "Authorization: Bearer $(gcloud auth print-access-token)" -H "Content-Type: application/json; charset=utf-8" -d "" "httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts/ SA_ID:enable" PowerShell (Windows) Execute the following command: $cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method POST ` -Headers $headers ` -Uri "httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts/ SA_ID:enable" | Select-Object -Expand Content API Explorer (browser) Open the method reference page The API Explorer panel opens on the right side of the page You can interact with this tool to send requests Complete any required fields and click **Execute** If successful, the response body will be empty C++ To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM C++ API reference documentation namespace iam = ::google::cloud::iam; std::string const& name) { iam::IAMClient client(iam::MakeIAMConnection google::iam::admin::v1::EnableServiceAccountRequest request; request.set_name(name); auto response = client.EnableServiceAccount(request); if (!response.ok throw std::runtime_error(response.message std::cout << "ServiceAccount successfully enabled. "; } C# To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM C# API reference documentation using System; using Google.Apis.Auth.OAuth2; using Google.Apis.Iam.v1; using Google.Apis.Iam.v1.Data; public partial class ServiceAccounts { public static void EnableServiceAccount(string email) { var credential = GoogleCredential.GetApplicationDefault() .CreateScoped(IamService.Scope.CloudPlatform); var service = new IamService(new IamService.Initializer { HttpClientInitializer = credentialvar request = new EnableServiceAccountRequest string resource = "projectsserviceAccounts/" + email; service.Projects.ServiceAccounts.Enable(request, resource).Execute Console.WriteLine("Enabled service account: " + email); } } Go To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Go API reference documentation import ( "context" "fmt" "io" iam "google.golang.org/api/iam/v1" ) // enableServiceAccount enables a service account. func enableServiceAccount(w io.Writer, email string) error { // email:= service-account@your-project.iam.gserviceaccount.com ctx := context.Background() service, err := iam.NewService(ctx) if err != nil { return fmt.Errorf("iam.NewService: %v", err) } request := &iam.EnableServiceAccountRequest{} _, err = service.Projects.ServiceAccounts.Enable("projectsserviceAccountsemail, request).Do() if err != nil { return fmt.Errorf("Projects.ServiceAccounts.Enable: %v", err) } fmt.Fprintf(w, "Enabled service account: %v", email) return nil } Java To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Java API reference documentation import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport; import com.google.api.client.json.jackson2.JacksonFactory; import com.google.api.services.iam.v1.Iam; import com.google.api.services.iam.v1.IamScopes; import com.google.api.services.iam.v1.model.EnableServiceAccountRequest; import com.google.auth.http.HttpCredentialsAdapter; import com.google.auth.oauth2.GoogleCredentials; import java.io.IOException; import java.security.GeneralSecurityException; import java.util.Collections; public class EnableServiceAccount { // Enables a service account. public static void enableServiceAccount(String projectId, String serviceAccountName) { // String projectId = "my-project-id"; // String serviceAccountName = "my-service-account-name"; Iam service = null; try { service = initService } catch (IOException | GeneralSecurityException e) { System.out.println("Unable to initialize service: " + e.toString return; } String serviceAccountEmail = serviceAccountName ++ projectId + ".iam.gserviceaccount.com"; try { EnableServiceAccountRequest request = new EnableServiceAccountRequest service .projects() .serviceAccounts() .enable("projectsserviceAccounts/" + serviceAccountEmail, request) .execute System.out.println("Enabled service account: " + serviceAccountEmail); } catch (IOException e) { System.out.println("Unable to enable service account: " + e.toString } } private static Iam initService() throws GeneralSecurityException, IOException { // Use the Application Default Credentials strategy for authentication. For more info, see: // httpscloud.google.com/docs/authentication/production#finding_credentials_automatically GoogleCredentials credential = GoogleCredentials.getApplicationDefault() .createScoped(Collections.singleton(IamScopes.CLOUD_PLATFORM // Initialize the IAM service, which can be used to send requests to the IAM API. Iam service = new Iam.Builder( GoogleNetHttpTransport.newTrustedTransport JacksonFactory.getDefaultInstance new HttpCredentialsAdapter(credential)) .setApplicationName("service-accounts") .build return service; } } Python To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Python API reference documentation import os from google.oauth2 import service_account import googleapiclient.discovery def enable_service_account(email): Enables a service account credentials = service_account.Credentials.from_service_account_file( filename=os.environ['GOOGLE_APPLICATION_CREDENTIALS scopeshttpswww.googleapis.com/auth/cloud-platform service = googleapiclient.discovery.build( 'iam', 'v1', credentials=credentials) service.projectsserviceAccountsenable( name='projectsserviceAccounts/' + email).execute() print("Enabled service account :" + email) ## Deleting a service account When you delete a service account, applications will no longer have access to Google Cloud resources through that service account. If you delete the default App Engine and Compute Engine service accounts, the instances will no longer have access to resources in the project Delete with caution; make sure your critical applications are no longer using a service account before deleting it. If you're not sure whether a service account is being used, we recommend disabling the service account before deleting it. Disabled service accounts can be easily re-enabled if they are still in use If you delete a service account, then create a new service account with the same name, the new service account is treated as a separate identity; it does not inherit the roles granted to the deleted service account. In contrast, when you delete a service account, then undelete it, the service account's identity does not change, and the service account retains its roles When a service account is deleted, its role bindings are not immediately removed; they are automatically purged from the system after a maximum of 60 days. Until that time, the service account appears in role bindings with a deleted: prefix and a ?uid= suffix, where `NUMERIC_ID` is a unique numeric ID for the service account `NUMERIC_ID` Deleted service accounts do not count towards your service account quota Console In the Google Cloud console, go to the Service accountspage Select a project Select the service account you want to delete, and then click Delete gcloud CLI Execute the gcloud iam service-accounts delete command to delete a service account Command: gcloud iam service-accounts delete SA_NAME@ PROJECT_ID.iam.gserviceaccount.com Output: Deleted service account SA_NAME@ PROJECT_ID.iam.gserviceaccount.com REST The serviceAccounts.delete method deletes a service account Before using any of the request data, make the following replacements: : Your Google Cloud project ID. Project IDs are alphanumeric strings, like PROJECT_ID my-project : The ID of your service account. This can either be the service account's email address in the form SA_ID , or the service account's unique numeric ID SA_NAME@ PROJECT_ID.iam.gserviceaccount.com HTTP method and URL: DELETE httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts/ SA_ID To send your request, expand one of these options: curl (Linux, macOS, or Cloud Shell) Execute the following command: curl -X DELETE -H "Authorization: Bearer $(gcloud auth print-access-token)" "httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts/ SA_ID" PowerShell (Windows) Execute the following command: $cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method DELETE ` -Headers $headers ` -Uri "httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts/ SA_ID" | Select-Object -Expand Content API Explorer (browser) Open the method reference page The API Explorer panel opens on the right side of the page You can interact with this tool to send requests Complete any required fields and click **Execute** If successful, the response body will be empty C++ To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM C++ API reference documentation namespace iam = ::google::cloud::iam; std::string const& name) { iam::IAMClient client(iam::MakeIAMConnection auto response = client.DeleteServiceAccount(name); if (!response.ok throw std::runtime_error(response.message std::cout << "ServiceAccount successfully deleted. "; } C# To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM C# API reference documentation using System; using Google.Apis.Auth.OAuth2; using Google.Apis.Iam.v1; public partial class ServiceAccounts { public static void DeleteServiceAccount(string email) { var credential = GoogleCredential.GetApplicationDefault() .CreateScoped(IamService.Scope.CloudPlatform); var service = new IamService(new IamService.Initializer { HttpClientInitializer = credentialstring resource = "projectsserviceAccounts/" + email; service.Projects.ServiceAccounts.Delete(resource).Execute Console.WriteLine("Deleted service account: " + email); } } Go To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Go API reference documentation import ( "context" "fmt" "io" iam "google.golang.org/api/iam/v1" ) // deleteServiceAccount deletes a service account. func deleteServiceAccount(w io.Writer, email string) error { ctx := context.Background() service, err := iam.NewService(ctx) if err != nil { return fmt.Errorf("iam.NewService: %v", err) } _, err = service.Projects.ServiceAccounts.Delete("projectsserviceAccounts/" + email).Do() if err != nil { return fmt.Errorf("Projects.ServiceAccounts.Delete: %v", err) } fmt.Fprintf(w, "Deleted service account: %v", email) return nil } Java To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Java API reference documentation import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport; import com.google.api.client.json.jackson2.JacksonFactory; import com.google.api.services.iam.v1.Iam; import com.google.api.services.iam.v1.IamScopes; import com.google.auth.http.HttpCredentialsAdapter; import com.google.auth.oauth2.GoogleCredentials; import java.io.IOException; import java.security.GeneralSecurityException; import java.util.Collections; public class DeleteServiceAccount { // Deletes a service account. public static void deleteServiceAccount(String projectId, String serviceAccountName) { // String projectId = "my-project-id"; // String serviceAccountName = "my-service-account-name"; Iam service = null; try { service = initService } catch (IOException | GeneralSecurityException e) { System.out.println("Unable to initialize service: " + e.toString return; } String serviceAccountEmail = serviceAccountName ++ projectId + ".iam.gserviceaccount.com"; try { service .projects() .serviceAccounts() .delete("projectsserviceAccounts/" + serviceAccountEmail) .execute System.out.println("Deleted service account: " + serviceAccountEmail); } catch (IOException e) { System.out.println("Unable to delete service account: " + e.toString } } private static Iam initService() throws GeneralSecurityException, IOException { // Use the Application Default Credentials strategy for authentication. For more info, see: // httpscloud.google.com/docs/authentication/production#finding_credentials_automatically GoogleCredentials credential = GoogleCredentials.getApplicationDefault() .createScoped(Collections.singleton(IamScopes.CLOUD_PLATFORM // Initialize the IAM service, which can be used to send requests to the IAM API. Iam service = new Iam.Builder( GoogleNetHttpTransport.newTrustedTransport JacksonFactory.getDefaultInstance new HttpCredentialsAdapter(credential)) .setApplicationName("service-accounts") .build return service; } } Python To learn how to install and use the client library for IAM, see IAM client libraries. For more information, see the IAM Python API reference documentation import os from google.oauth2 import service_account import googleapiclient.discovery def delete_service_account(email): Deletes a service account credentials = service_account.Credentials.from_service_account_file( filename=os.environ['GOOGLE_APPLICATION_CREDENTIALS scopeshttpswww.googleapis.com/auth/cloud-platform service = googleapiclient.discovery.build( 'iam', 'v1', credentials=credentials) service.projectsserviceAccountsdelete( name='projectsserviceAccounts/' + email).execute() print('Deleted service account: ' + email) ## Undeleting a service account In some cases, you can use the undelete command to undelete a deleted service account. You can usually undelete a deleted service account if it meets these criteria: The service account was deleted less than 30 days ago After 30 days, IAM permanently removes the service account. Google Cloud cannot recover the service account after it is permanently removed, even if you file a support request There is no existing service account with the same name as the deleted service account For example, suppose that you accidentally delete the service account my-service-account@project-id.iam.gserviceaccount.com. You still need a service account with that name, so you create a new service account with the same name, my-service-account@project-id.iam.gserviceaccount.com The new service account does not inherit the permissions of the deleted service account. In effect, it is completely separate from the deleted service account. However, you cannot undelete the original service account, because the new service account has the same name To address this issue, delete the new service account, then try to undelete the original service account If you are not able to undelete the service account, you can create a new service account with the same name; revoke all of the roles from the deleted service account; and grant the same roles to the new service account. For details, see Policies with deleted principals Finding a deleted service account's numeric ID When you undelete a service account, you must provide its numeric ID. The numeric ID is a 21-digit number, such as 123456789012345678901, that uniquely identifies the service account. For example, if you delete a service account, then create a new service account with the same name, the original service account and the new service account will have different numeric IDs If you know that a binding in an allow policy includes the deleted service account, you can get the allow policy, then find the numeric ID in the allow policy. The numeric ID is appended to the name of the deleted service account. For example, in this allow policy, the numeric ID for the deleted service account is 123456789012345678901: { "version": 1, "etag": "BwUjMhCsNvY "bindings": [ { "members": [ "deleted:serviceAccount:my-service-account@project-id.iam.gserviceaccount.com?uid=123456789012345678901 "role": "roles/iam.serviceAccountUser" }, ] } Numeric IDs are only appended to the names of deleted principals Alternatively, you can search your audit logs for the DeleteServiceAccount operation that deleted the service account: In the Google Cloud console, go to the Logs explorerpage In the query editor, enter the following query, replacing with the email address of your service account (for example, SERVICE_ACCOUNT_EMAIL my-service-account@project-id.iam.gserviceaccount.com): resource.type="service_account" resource.labels.email_id=" SERVICE_ACCOUNT_EMAIL" "DeleteServiceAccount" If the service account was deleted more than an hour ago, click Last 1 hour, select a longer period of time from the drop-down list, then click Apply Click Run query. The Logs Explorer displays the DeleteServiceAccountoperations that affected service accounts with the name you specified Find and note the numeric ID of the deleted service account by doing one of the following: If the search results include only one DeleteServiceAccountoperation, find the numeric ID in the Unique IDfield of the Log fieldspane If the search results show more than one log, do the following: Find the correct log entry. To find the correct log entry, click theexpander arrow next to a log entry. Review the details of the log entry and determine whether the log entry shows the operation that you want to undo. Repeat this process until you find the correct log entry In the correct log entry, locate the service account's numeric ID. To locate the numeric ID, expand the log entry's protoPayloadfield, then find the resourceNamefield The numeric ID is everything after serviceAccountsin the resourceNamefield - - Undeleting the service account by numeric ID After you find the numeric ID for the deleted service account, you can try to undelete the service account gcloud CLI Execute the gcloud beta iam service-accounts undelete command to undelete a service account Command: gcloud beta iam service-accounts undelete ACCOUNT_ID Output: restoredAccount: email: SA_NAME@ PROJECT_ID.iam.gserviceaccount.com etag: BwWWE7zpApg= name: projects/ PROJECT_ID/serviceAccounts/ SA_NAME@ PROJECT_ID.iam.gserviceaccount.com oauth2ClientId: '123456789012345678901' projectId: PROJECT_IDuniqueId: ' ACCOUNT_ID' REST The serviceAccounts.undelete method restores a deleted service account Before using any of the request data, make the following replacements: : Your Google Cloud project ID. Project IDs are alphanumeric strings, like PROJECT_ID my-project : The unique numeric ID of the service account SA_NUMERIC_ID HTTP method and URL: POST httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts/ SA_NUMERIC_ID:undelete To send your request, expand one of these options: curl (Linux, macOS, or Cloud Shell) Execute the following command: curl -X POST -H "Authorization: Bearer $(gcloud auth print-access-token)" -H "Content-Type: application/json; charset=utf-8" -d "" "httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts/ SA_NUMERIC_ID:undelete" PowerShell (Windows) Execute the following command: $cred = gcloud auth print-access-token $headers = @{ "Authorization" = "Bearer $cred" } Invoke-WebRequest ` -Method POST ` -Headers $headers ` -Uri "httpsiam.googleapis.com/v1/projects/ PROJECT_ID/serviceAccounts/ SA_NUMERIC_ID:undelete" | Select-Object -Expand Content API Explorer (browser) Open the method reference page The API Explorer panel opens on the right side of the page You can interact with this tool to send requests Complete any required fields and click **Execute** If the account can be undeleted, you receive a 200 OK response code with details about the restored service account, like the following: { "restoredAccount": { "name": "projects/my-project/serviceAccounts/my-service-account@my-project.iam.gserviceaccount.com", "projectId": "my-project", "uniqueId": "123456789012345678901", "email": "my-service-account@my-project.iam.gserviceaccount.com", "displayName": "My service account", "etag": "BwUp3rVlzes "description": "A service account for running jobs in my project", "oauth2ClientId": "987654321098765432109" } } ## What's next - Learn how to create and manage service account keys - Review the process for granting IAM roles to all types of principals, including service accounts - Explore how you can use role recommendations to downscope permissions for all principals, including service accounts - Understand how to allow principals to impersonate service accounts ## Try it for yourself If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.Get started for free