gcloud compute instances set-service-account - set a service account and access scopes for a Compute Engine VM instance

gcloud compute instances set-service-accountINSTANCE_NAME[--zone=ZONE][--scopes=[SCOPE,…]    |--no-scopes][--service-account=SERVICE_ACCOUNT    |--no-service-account][GCLOUD_WIDE_FLAG …]

As a best practice, grant thecloud-platform access scope on your VMinstance. Then, to restrict resource access, grant only the required IAM rolesto the VM instance's service account. For more information, seehttps://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#changeserviceaccountandscopes#best_practices.

INSTANCE_NAME

Name of the instance to operate on. For details on valid instance names, referto the criteria documented under the field 'name' at:https://cloud.google.com/compute/docs/reference/rest/v1/instances

--zone=ZONE

Zone of the instance to operate on. If not specified, you might be prompted toselect a zone (interactive mode only).gcloud attempts to identify theappropriate zone by searching for resources in your currently active project. Ifthe zone cannot be determined,gcloud prompts you for a selection withall available Google Cloud Platform zones.

To avoid prompting when this flag is omitted, the user can set thecompute/zone property:

gcloudconfigsetcompute/zoneZONE

A list of zones can be fetched by running:

gcloudcomputezoneslist

To unset the property, run:

gcloudconfigunsetcompute/zone

Alternatively, the zone can be stored in the environment variableCLOUDSDK_COMPUTE_ZONE.

At most one of these can be specified:

--scopes=[SCOPE,…]

If not provided, the instance will keep the scopes it currently has.

SCOPE can be either the full URI of the scope or an alias.Defaultscopes are assigned to all instances. Available aliases are:

Alias	URI
bigquery	https://www.googleapis.com/auth/bigquery
cloud-platform	https://www.googleapis.com/auth/cloud-platform
cloud-source-repos	https://www.googleapis.com/auth/source.full_control
cloud-source-repos-ro	https://www.googleapis.com/auth/source.read_only
compute-ro	https://www.googleapis.com/auth/compute.readonly
compute-rw	https://www.googleapis.com/auth/compute
datastore	https://www.googleapis.com/auth/datastore
default	https://www.googleapis.com/auth/devstorage.read_only
	https://www.googleapis.com/auth/logging.write
	https://www.googleapis.com/auth/monitoring.write
	https://www.googleapis.com/auth/pubsub
	https://www.googleapis.com/auth/service.management.readonly
	https://www.googleapis.com/auth/servicecontrol
	https://www.googleapis.com/auth/trace.append
gke-default	https://www.googleapis.com/auth/devstorage.read_only
	https://www.googleapis.com/auth/logging.write
	https://www.googleapis.com/auth/monitoring
	https://www.googleapis.com/auth/service.management.readonly
	https://www.googleapis.com/auth/servicecontrol
	https://www.googleapis.com/auth/trace.append
logging-write	https://www.googleapis.com/auth/logging.write
monitoring	https://www.googleapis.com/auth/monitoring
monitoring-read	https://www.googleapis.com/auth/monitoring.read
monitoring-write	https://www.googleapis.com/auth/monitoring.write
pubsub	https://www.googleapis.com/auth/pubsub
service-control	https://www.googleapis.com/auth/servicecontrol
service-management	https://www.googleapis.com/auth/service.management.readonly
sql (deprecated)	https://www.googleapis.com/auth/sqlservice
sql-admin	https://www.googleapis.com/auth/sqlservice.admin
storage-full	https://www.googleapis.com/auth/devstorage.full_control
storage-ro	https://www.googleapis.com/auth/devstorage.read_only
storage-rw	https://www.googleapis.com/auth/devstorage.read_write
taskqueue	https://www.googleapis.com/auth/taskqueue
trace	https://www.googleapis.com/auth/trace.append
userinfo-email	https://www.googleapis.com/auth/userinfo.email

DEPRECATION WARNING:https://www.googleapis.com/auth/sqlserviceaccount scope andsql alias do not provide SQL instance managementcapabilities and have been deprecated. Please, usehttps://www.googleapis.com/auth/sqlservice.adminorsql-admin to manage your Google SQL Service instances.

--no-scopes

Remove all scopes from the instance

At most one of these can be specified:

--service-account=SERVICE_ACCOUNT

A service account is an identity attached to the instance. Its access tokens canbe accessed through the instance metadata server and are used to authenticateapplications on the instance. The account can be set using an email addresscorresponding to the required service account. You can explicitly specify theCompute Engine default service account using the 'default' alias.

If not provided, the instance will use the service account it currently has.

--no-service-account

Remove service account from the instance

Run$gcloud help for details.