Creating short-lived service account credentials from the GCP Console

Question

I'm trying to create short-lived service account credentials. I'm working from https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#creating_a_limited-privilege_service_account , which describes how to do it with the REST API, but I want to do it from the GCP Console. In particular, I'm trying to perform the equivalent of the serviceAccounts.setIamPolicy() request.

How can I update the policy for a service account to add a binding (as is described in the link above), using the GCP console?

Thanks in advance.

Elliott

Answer 1

If we look at this article called How to impersonate Service Accounts in Google Cloud we find an explicit statement that reads:

Account Specific ( only possible from command line — NO option in Console)

This seems to say to me that if we want to treat the service account as a resource and allow it to setup short-lived credentials, we must use the APIs.

Answer 2

You are confusing service accounts and OAuth Access Tokens.

The Google Cloud Console and the CLI can create a service account. A service account does not expire, but it can be revoked. Service Accounts are used to create Google Cloud OAuth 2.0 Access Tokens (and Identity Tokens).

You cannot create an OAuth Access Token in the Google Cloud Console. You can create OAuth Access Tokens with the CLI gcloud or using APIs.

All Google Cloud OAuth Access Tokens are short-lived. The default and the max expiration time is 3,600 seconds. If you want a shorter token lifetime, you will need to create it yourself using API calls and/or OAuth endpoints.

I wrote an article that shows how to create Google OAuth Access Tokens including source code. You can change the code to create tokens with any expiration up to 3,600 seconds.

Google Cloud – Creating OAuth Access Tokens for REST API Calls

If you want to assign IAM roles to a service account you can. This can be done in the Google Cloud Console, using the CLI gcloud or by API call. This is independent of the OAuth Access Token. IAM Roles are not assigned to tokens. IAM Roles are assigned to the account member ID. These permissions will be valid for any OAuth Token that is created by the service account unless limited by scopes. If you want to change the scopes at the time the OAuth Access Token is generated, you must write your own code to do so at the time the token request is made.