Service accounts

A machine can run as a CBWS service account. Software on the machine then calls CBWS platform services as that account, with no key file to copy onto it or rotate.

Attaching a service account

The service account is chosen when the machine is created.

CLI

cbws compute machines create my-machine s1.4 \
    --service-account deployer@my-project.iam-sa.cbws.xyz

Attaching an account requires the iam.cbws.xyz/ServiceAccount/actAs permission on it.

What the machine may do is what the account may do, so grant the account the roles it needs on the project, as described in Managing access:

cbws projects add-member serviceAccount deployer@my-project.iam-sa.cbws.xyz --role <role>

Using it on the machine

The machine's metadata service hands out short-lived tokens for the account. The CBWS CLI and the Go SDK use it automatically when nothing else is configured, and act on the machine's project by default:

cbws who-am-i

Warning

Anything that runs on the machine can get tokens for its service account. Give the account only the access that everything on the machine may have.