Google Cloud : Security with Service Accounts # made Simple?

*******************************************************************Google cloud : security landscape

• Service account is an Identity
• SA is always attached to a single GCP Project ID
• Each SA has its own Private Key
• Keep Private key secured
• Rotate Private key frequently
• we can attach SA to an GCP resource : VM, Container, Pod, etc
• using SA : private key -> you can access GCP API and Service calls
• Using SA Private Key, the User can generate a signed JSON Web Token

*******************************************************************How to use SA : Private key

(Create JWT Token -> Token is Signed with SA Private Key ->Use Signed JWT Token to get new Google Token -> use Google Token to call GCP API)

*******************************************************************Attributes of SA:

• SA_email_id = “service_account_name@GCP_Proj_Name.iam.gservice_account.com”
• SA = “projects/GCP_Proj_name/ServiceAccounts/”+SA_email_id

*******************************************************************

Contents of Service account : credentials file

1. Type = Service Account
2. Project ID = GCP Project ID
3. Private Key id = ***
4. Private key = hash_value**
5. client_email=svc_acct_name@GCP_proj_name.iam.serviceaccount.com
6. client_id =****
7. auth_uri = google auth
8. token_uri = google auth token
9. auth_provider_X509_cert_url = google api oauth2
10. client_X509_cert_url =google metadata

*******************************************************************