> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP service accounts

> Give people gcloud access to Google Cloud as a service account.

A GCP service account lets people use `gcloud` as a service account without handing out a service account key. When someone launches a session, Infisical gets a short-lived access token for the service account. Their Google Cloud requests go through a [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md), which adds the token to each request, and Infisical records each request's method, URL, and response status.

GCP service accounts only support the CLI, not browser access.

## Prerequisites

* The Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md) on the [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md) you'll add the account to
* A Gateway that can reach `googleapis.com` on port `443`
* The [`gcloud` CLI](https://cloud.google.com/sdk/docs/install) on the machine of each person who connects

## Choose an authentication method

The account gets tokens for the target service account in one of two ways:

* **Impersonation (Recommended)**: Infisical [impersonates](https://cloud.google.com/iam/docs/service-account-impersonation) the target service account with its own Google Cloud service account, so no key is created or stored
* **Static Key**: Infisical stores a service account key, either for the target service account or for another service account that's allowed to impersonate it

### Set up impersonation

**Step 1**

Check that the ID of the target service account ends with the first two sections of your Infisical organization ID, shown under **Organization ID** in your organization's **Settings**. For example, if your organization ID is `df92581a-0fe9-42b5-b526-0a1e88ec8085`, the service account ID must end with `df92581a-0fe9`, as in `pam-df92581a-0fe9@my-project.iam.gserviceaccount.com`.

If the ID has a different ending, create a service account with a matching ID, or [use a static key](#set-up-a-static-key) instead.

**Step 2**

In the Google Cloud project of the target service account, enable the IAM Service Account Credentials API (`iamcredentials.googleapis.com`). Without this API, sessions fail when Infisical requests a token.

**Step 3**

Find the service account that Infisical impersonates with:

| Infisical instance | Infisical's service account |
| - | - |
| Infisical Cloud (US) | `infisical-us@infisical-us.iam.gserviceaccount.com` |
| Infisical Cloud (EU) | `infisical-eu@infisical-eu.iam.gserviceaccount.com` |
| Self-hosted | The service account in your instance's `INF_APP_CONNECTION_GCP_SERVICE_ACCOUNT_CREDENTIAL` environment variable |

If you self-host Infisical and haven't set that variable, follow the self-hosted steps in [GCP connection](https://infisical.com/docs/integrations/app-connections/gcp.md) first.

**Step 4**

In the Google Cloud console, go to **IAM & Admin** > **Service Accounts** and select the target service account.

**Step 5**

On the **Permissions** tab, select **Grant access**. Add Infisical's service account as a principal with the **Service Account Token Creator** role (`roles/iam.serviceAccountTokenCreator`).

### Set up a static key

**Step 1**

In the Google Cloud console, go to **IAM & Admin** > **Service Accounts** and select the service account whose key you'll store.

**Step 2**

On the **Keys** tab, select **Add key** > **Create new key**, choose **JSON**, and select **Create**. The key file downloads to your machine.

## Create an account

**Step 1**

Go to **Privileged Access Management** > **Accounts** and select **Add Account**.

**Step 2**

Select the **Folder** to add the account to. Under **Account Template**, select a GCP service account [template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md), such as the default `gcp-service-account` template, then select **Next**.

**Step 3**

Enter a **Name** for the account and the **Service Account Email** of the target service account, which ends in `.iam.gserviceaccount.com`. If the template doesn't set a Gateway, select one under **Gateway**.

**Step 4**

Select the **Auth Method** you set up. For **Static Key**, paste the contents of the key file into **Service Account Key JSON**.

**Step 5**

Select **Create**.

## Connect

To learn how to launch a session, see [Connect to an account](https://infisical.com/docs/documentation/platform/pam/accounts/connect.md). The CLI command for the account is:

```bash theme={"dark"}
infisical pam access <folder>/<account>
```

The CLI points `gcloud` at a local proxy for the session, so `gcloud` works without any other setup:

```bash theme={"dark"}
gcloud compute instances list
```

Press `Ctrl+C` to end the session. The CLI then restores your `gcloud` configuration.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.