Aservice account is a special type of account in Google Cloud that enables components and applications of a system to interact with each other and with other APIs. For more information about Google Cloud, seeAbout Google Cloud services.

There are several ways to create service accounts, including:

• (Recommended)create-service-account tool
• Google Cloud console
• gcloud SDK

Each of these is described in the following sections.

Use thecreate-service-account tool

Thecreate-service-account tool is available after youdownload and expandapigeectl in thetools/ directory. It hybrid component-specific service accounts and assigns the required roles for you. The tool also automatically downloads the service account keys and stores them on your local machine.

For example, the following command will create all the separate individual service accounts for a production environment, assign the appropriate IAM roles to each service account, and download each accounts private key file to the./service-accounts directory:

./tools/create-service-account --env prod

The following command creates a single service account namedapigee-non-prod with all IAM roles for all hybrid components, suitable for demo and test environments, but not for production environments:

./tools/create-service-account --env non-prod

For more information on usingcreate-service-account, seecreate-service-account reference.

Use the Google Cloud console

You can create service accounts with the Google Cloud console.

1. Create a service account:

   1. In the Cloud console, go to theService Accounts page.

      Go to Service Accounts

   2. Select your project.
   3. ClickaddCreate Service Account.

   4. In theService account name field, enter a name. The Cloud console fills in theService account ID field based on this name.

      Apigee recommends that you use a name that reflects the service account's role; you can set the name of the service account to be the same name as the component that uses it. For example, set the name of the Logs Writer service accountapigee-logger.

      For more information about the service accounts names and roles, seeService accounts and roles used by hybrid components.

   5. Optional: In theService account description field, enter a description for the service account. Descriptions are helpful at reminding you what a particular service account is used for.
   6. ClickCreate and continue.

   7. Click theSelect a role field and select a role, as described inService accounts and roles used by hybrid components. If the Apigee roles do not appear in the drop down list, refresh the page.

      For example, for the logging component, select the Logs Writer role.

      If necessary, enter text to filter the list of roles by name. For example, to list only the Apigee roles, enterApigee in the filter field.

      You can add more than one role to a service account, but Apigee recommends that you only use one role for each of the recommended service accounts. To change the roles of a service account after you have created it, use theIAM page in the Cloud console.

      Note: If you do not see the roles listed inRecommended service accounts, check with your Apigee account representative to be sure that your account was properly configured and that your organization was provisioned.
   8. ClickContinue.

      Google Cloud displays theGrant users access to this service account view:

      

   9. UnderCreate key (optional), clickCreate Key.

      Google Cloud gives you the option to download a JSON or P12 key:

      

   10. Select JSON (the default) and clickCreate.

       Google Cloud saves the key file in JSON format to your local machine and displays a confirmation when it is successful, as the following example shows:

       

       You will later use some of the service account keys to configure hybrid runtime services. For example, when you configure the hybrid runtime, you will specify the location of the service account keys using theSERVICE_NAME.serviceAccountPath properties.

       These keys are used by the service accounts to get access tokens, which the service account then uses to make requests against the Apigee APIs on your behalf. (But that's not for a while yet; for now, just remember where you saved it.)

   11. Repeat steps 4 through 11 for each service account listed inService accounts and roles used by hybrid components (except theapigee-mart account—which has no role associated with it—so do not assign it a role).

       When you're finished, you should have the following service accounts (in addition to the defaults, if any):

       

       In the Google Cloud console, service accounts are indicated with the icon.

   After you create a service account, if you want to add or remove a role to it, you must use theIAM & Admin view. You cannot manage roles for service accounts in theService accounts view.

   Tip: Apigee hybrid includes a validator that checks your service accounts' key files and permissions whenapigeectl applies the Apigee hybrid runtime components to your cluster. This validation is enabled by default. For more information, seeService account validation.

   Use the gcloud service account creation APIs

   You can create and manage service accounts with the Cloud Identity and Access Management API.

   For more information, seeCreatingand managing service accounts.

   Troubleshooting

   Deleting and recreating service accounts:Note that reusing the name of a deleted service account, may result in unexpected behavior. If you create a service account and delete it, always recreate it with a unique name. For details, see Deleting and recreating service accounts.