Service Accounts & Workload Identity
Special non-human identities used by applications and automated workloads to authenticate to GCP APIs.
Special non-human identities used by applications and automated workloads to authenticate to GCP APIs.
What is Service Accounts & Workload Identity?
A Service Account is a special Google identity associated with an application rather than an individual person. Applications use service accounts to authenticate securely when calling GCP APIs. Service accounts can be assigned IAM roles directly, and modern architectures utilize Workload Identity Federation to authenticate external applications (GitHub Actions, AWS, Kubernetes) with zero static JSON private keys.
Decision Guide: When to Choose This Service
Use Service Accounts for VM instances, Cloud Run containers, GKE pods, CI/CD pipelines, and background scripts that need to call Google APIs programmatically without human credentials.
Do NOT create service accounts for individual human users (use human Google Cloud Identity / Google Workspace accounts).
Core Architectural Pillars
Default service accounts created automatically have broad Editor roles (disable them in production); always create dedicated User-Managed service accounts.
Automatically generated via instance metadata servers (`http://metadata.google.internal/`) without private key storage.
Maps Kubernetes Service Accounts directly to GCP Service Accounts.
Authenticate GitHub Actions, GitLab, and AWS workloads using OpenID Connect (OIDC) tokens with zero static JSON keys.
Required to attach a service account to a compute instance.