Service Accounts

Imagine your application needs to:

• Access a database
• Store files in Cloud Storage
• Call other cloud services

Now here’s the catch
Your app is not a human, so it can’t log in with an email & password

So how does it get permission?

You create a special identity for your app
It gets controlled access
It works securely in the background

That identity is called a Service Account

What is a Service Account?

A Service Account is a special account used by applications or services to interact with GCP resources.

It is not for humans, but for:

• Applications
• Virtual Machines
• Cloud services

User vs Service Account

How Service Accounts Work

1. Create service account
2. Assign roles (permissions)
3. Attach to resource (VM/app)
4. Resource uses it to access services

Technical Example (Create Service Account)

Grant Role

Now this service account can access Cloud Storage

Where Are Service Accounts Used?

• Virtual Machines
• Cloud Run services
• App Engine apps
• APIs

Real-Life Examples

1. VM Accessing Storage

• VM uses service account
• Reads/writes files securely

2. Backend API

• Access database without exposing credentials

3. CI/CD Pipelines

• Deploy apps automatically

4. Microservices

• Services communicate securely