如何下载服务帐号Json？

Question

I have a impersonated a Service Account in gcloud through the command gcloud config set auth/impersonate_service_account [SA_FULL_EMAIL] .

Now, all my API calls are impersonating the Service Account., is there a way to download the Service Account JSON at this point?

Because I do not have the original Service Account JSON that was created earlier and also as an User I do not have permissions to Manage Keys for this Service Account.

Please let me know, if I can download the Service Account JSON from gcloud by impersonating the Service Account.

Thanks in advance!

Answer 1

I do not have permissions to Manage Keys for this Service Account

Without those permissions, you cannot create or download service account JSON keys. If the service account has those permissions, which it should not for security reasons, then yes.

The following command will create a new JSON key and download it:

gcloud iam service-accounts keys create my-service-account.json --iam-account <EMAIL ADDRESS>