When creating Google Cloud service accounts do you have to authorize the key after you create it?

user_259811 0
Viewed 2985

When you make a Google Cloud service account using the gcloud command line interface there's a gcloud iam service-accounts keys create to create a key. Looking in the web console, it appears that command creates and registers the key with the account.

Is that sufficient to active the service account for use with they generated JSON key file? Or do you also have to call:

gcloud auth activate-service-account <IAM> --key-file=<JSON file from the keys create command>

The Google docs are a little unclear here as to whether that last step is necessary or not. The console shows no changes to the service account but the command executes successfully if you do make the call.

gcloud google-cloud-platform
2 Answers

You do not have to use activate-service-account. You can instead use the environment variable 'CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE' to specify your service account json key.

CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE="./service-account.json" \
  gcloud deployment-manager deployments \
  create $DEPLOYMENT \
  --project $PROJECT \
  --template resources.jinja \
  --properties deployment:$DEPLOYMENT,project:$PROJECT

I found this option here: https://serverfault.com/questions/848580/how-to-use-google-application-credentials-with-gcloud-on-a-server

user_22552420
Related