gce_service_account.md

Create A Service Account

You can find complete documentation on creating a service account.

Here's a cheatsheet for the usual steps we do:

1. In the Google Cloud Console, go to Create service account page
2. Select the pul-gcdc project if you have access to more than one.
3. Enter a service account name to display in the Google Cloud console. The Google Cloud console generates a service account ID based on this name. Edit the ID if necessary. You cannot change the ID later.
4. Enter a description of the service account.
5. Choose one or more IAM roles to grant to the service account on the project.
6. When you are done adding roles, click Continue.
7. Click Done to finish creating the service account.

Create service account keys

You can find complete documentation on creating and deleting service account keys.

You will almost certainly want to create keys for this account. Use the following steps:

1. In the Google Cloud console, go to Service accounts.
2. Select the pul-gcdc project if you have access to more than one.
3. Click the email address of the service account that you want to create a key for.
4. Click the Keys tab.
5. Click the Add key drop-down menu, then select Create new key.
6. Select JSON as the Key type and click Create.
7. Add the new key to Lastpass and/or Princeton Ansible’s vault.

Clicking Create downloads a service account key file. After you download the key file, you cannot download it again.