Where can I see the PubSub service account?

user_39242 0
Viewed 1072

The PubSub service account is service-<PROJECT_NUMBER>@gcp-sa-pubsub.iam.gserviceaccount.com

The command described here to create an IAM policy binding succeeds, which shows that the service account exists.

But it does not appear in

  • the list of service accounts in the console https://console.cloud.google.com/iam-admin/serviceaccounts?project=<PROJECT> (screenshot below)
  • nor in the IAM permissions list https://console.cloud.google.com/iam-admin/iam?project=<PROJECT> , even when I check "Include Google-provided role grants"
  • nor in the output of gcloud iam service-accounts list --project <PROJECT>.

Where can I see this service account listed?

enter image description here

google-cloud-pubsub google-iam service-accounts google-cloud-platform
1 Answers

The service-<PROJECT_NUMBER>@gcp-sa-pubsub.iam.gserviceaccount.com is a Google managed service account, therefore, you can see it in the list YOUR PROJECT service accounts.

In addition, you have granted this service account on a TOPIC resource and not on a PROJECT resource. Therefore, when you go on the iam-admin page, you can see the service account at the PROJECT ressource.

Anyway, you could be able to view it in the iam-admin page by checking Include Google-provided role grants

enter image description here

Because you have granted the service account at TOPIC resource level, you can see it in the TOPIC page

Go to the topic page, check a topic and go to the right-hand panel, in the permission section and look at the role that you grant on the service account. You will find it

enter image description here

user_113725930
Related