If an user impersonates a service account in gcloud CLI and they access the console.cloud.google.com dashboard, will the roles applicable for the service account be used or will the user specific roles be used?
Thanks in advance!
1 Answers
Yes, same roles will be applied to the user. From what I understand and experience, the concept of service account impersonation is to allow a user to that specific service account with specific roles and access to the resource.
Benefits of service account impersonation are:
- limit user account permission
- reduce the risk of service account keys
- easy maintenance by removing the user from service account resource
For your reference, you can check out more on this Google Cloud IAM documentation.
Related