我需要使用哪些 IAM 权限来创建类似于默认计算引擎服务帐户的服务帐户？

Question

I've deleted the default service account and it has been longer than 30 days. I don't know if it applies to all marketplace solutions, but the one that I want to use can't be launched without the compute engine default service account.

What are the IAM permissions I need to set to create a service account that has the same permissions as the compute engine default service account to launch VM from marketplace?

I tried Compute Admin, compute.imageUser and Compute Instance Admin, but to no avail.

In addition to that, why does the marketplace solution require the default service account when it is recommended to disable/remove the default compute engine service account because of the editor role?

Answer 1

What is the compute engine default service account?

By default, the account is automatically granted the project editor role on the project and is listed in the IAM section of Cloud Console. This service account is only deleted when the project is deleted. However, you can change the roles granted to this account, including revoking all access to your project.

Documentation

Answer 2

You can undelete a service account only if it is deleted fewer than 30 days ago.

Instead of that, we can create a new service account and grant an 'Editor' role to it, as a default compute engine service account has the same role by default. Refer to Compute Engine default service account for more information.

To set the service account as the compute engine default service account on the project, we can use the following command :

gcloud alpha compute project-info set-default-service-account

But since the command is in the 'alpha' launch stage , it is not available for everyone.

I could suggest the following options:

1. Create a new project .
2. Request an Alpha feature that allows setting a new service account as the compute engine default service account.

If you have questions regarding an Alpha release or participation in an Alpha program, please reach out to sales . In this case a sales team needs to approve it.