Skip to content

Service accounts

A service account is an identity for software, such as an application, a script or a CI job, rather than a person. It lives in a project and is named by its email, {id}@{project}.iam-sa.cbws.xyz.

A service account is also a resource of its own. Roles granted to the account decide what it can do. Roles granted on the account decide who may act as it.

Creating a service account

The id is 6 to 30 lowercase letters, digits and dashes, starting with a letter.

cbws iam service-accounts create deployer
cbws iam service-accounts list

Granting it access

A new service account can do nothing. Grant it a role on the project, the same way as for a user, as described in Managing access.

cbws projects add-member serviceAccount deployer@my-project.iam-sa.cbws.xyz --role <role>

Authenticating as a service account

There are three ways to act as a service account. Prefer the first two, which need no long-lived secret.

On a CBWS machine

Software on a machine that runs as a service account gets tokens for it from the metadata service.

cbws compute machines create my-machine s1.4 --service-account deployer@my-project.iam-sa.cbws.xyz

Attaching an account requires the iam.cbws.xyz/ServiceAccount/actAs permission on it.

With a short-lived token

Someone with their own CBWS identity can mint a short-lived token for the account. This requires the token generator role on the account, which add-member grants by default:

cbws iam service-accounts add-member deployer user colleague@example.com
cbws iam service-accounts generate-access-token deployer

Granting the role on one account, rather than on the project, keeps it from reaching every service account in the project.

With a key

A key is a credentials file for software outside the platform.

cbws iam service-accounts keys create deployer --output deployer.json

The private key exists only in that file and cannot be fetched again. Store it as a secret, and point CBWS_CREDENTIALS at it to run the CBWS CLI or the Go SDK as the account:

CBWS_CREDENTIALS=deployer.json cbws who-am-i

List and remove keys with:

cbws iam service-accounts keys list deployer
cbws iam service-accounts keys delete deployer <key-id>

Who may act as an account

The account's own policy decides this, see Managing access.

cbws iam service-accounts get-iam-policy deployer
cbws iam service-accounts remove-member deployer user colleague@example.com

Deleting a service account

Warning

Deleting an account also deletes its keys, so anything still authenticating as it stops working.

cbws iam service-accounts delete deployer