Creates Google Cloud Platform (GCP) service accounts with roles that allowindividual Apigee hybrid components to make authorized API calls and downloads the associated service account key files. You can usethe service account key files generated by this command in your configuration overrides file.

Thecreate-service-account tool is located inhybrid_root_dir/tools directory.

Prerequisites

Thecreate-service-account tool requires that thegcloud CLI beinstalled. Users invoking the utility should have the roleService Account Admin.

To get started, be sure yourgcloud projectconfiguration is set to the project you created inStep 2: Create a Google Cloud project:

gcloud config list project

If you need to change the current project ID, use this command:

gcloud config set projectgcp_project_id

Wheregcp_project_id is the project created inStep 2: Create a Google Cloud project.

create-service-account syntax

Thecreate-service-account tool uses the following syntax:

create-service-accountcomponent_nameoutput_dir [gcp_project_id]

Where:

• component_name: Specifies the hybrid service that uses the service account. Valid values are:
  • apigee-cassandra
  • apigee-logger
  • apigee-mart
  • apigee-metrics
  • apigee-synchronizer
  • apigee-udca

  Note that thecreate-service-account tool cannot create theapigee-org-admin service account. You must create that either with the GCP or gCloud APIs, as described inCreate service accounts.

• output_dir: The output directory in which to store the downloaded service account key.
• gcp_project_id: (Optional) Specifies the GCP project ID of the project that is bound to your hybrid-enabled organization. If the GCP project ID is not provided, the tool attempts to retrieve it from the current gcloud configuration.

[ERROR]: No roles found for component apigee-mart

• CreatesGCP service accounts used by hybrid components. The created service account is granted the role required by the specific component to operate.
• Downloads the service account key to your system. You place the service account keys in your hybrid configuration overrides file, as explained in the hybridinstallation instructions.

The tool creates service accounts for the following components:

You can also create service accounts in the GCP Console. See alsoCreating and managing service accounts.

Example

The following example creates a new service account for theapigee-loggerservice and places the downloaded key in the./service-accounts directory.

./my-hybrid-root/tools/create-service-account apigee-logger ./service-accounts