Skip to main content
A GCP service account lets people use gcloud as a service account without handing out a service account key. When someone launches a session, Infisical gets a short-lived access token for the service account. Their Google Cloud requests go through a Gateway, which adds the token to each request, and Infisical records each request’s method, URL, and response status. GCP service accounts only support the CLI, not browser access.

​
Prerequisites

  • The Admin role on the folder you’ll add the account to
  • A Gateway that can reach googleapis.com on port 443
  • The gcloud CLI on the machine of each person who connects

​
Choose an authentication method

The account gets tokens for the target service account in one of two ways:
  • Impersonation (Recommended): Infisical impersonates the target service account with its own Google Cloud service account, so no key is created or stored
  • Static Key: Infisical stores a service account key, either for the target service account or for another service account that’s allowed to impersonate it

​
Set up impersonation

1
Check that the ID of the target service account ends with the first two sections of your Infisical organization ID, shown under Organization ID in your organization’s Settings. For example, if your organization ID is df92581a-0fe9-42b5-b526-0a1e88ec8085, the service account ID must end with df92581a-0fe9, as in [email protected].If the ID has a different ending, create a service account with a matching ID, or use a static key instead.
2
In the Google Cloud project of the target service account, enable the IAM Service Account Credentials API (iamcredentials.googleapis.com). Without this API, sessions fail when Infisical requests a token.
3
Find the service account that Infisical impersonates with:If you self-host Infisical and haven’t set that variable, follow the self-hosted steps in GCP connection first.
4
In the Google Cloud console, go to IAM & Admin > Service Accounts and select the target service account.
5
On the Permissions tab, select Grant access. Add Infisical’s service account as a principal with the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator).

​
Set up a static key

1
In the Google Cloud console, go to IAM & Admin > Service Accounts and select the service account whose key you’ll store.
2
On the Keys tab, select Add key > Create new key, choose JSON, and select Create. The key file downloads to your machine.

​
Create an account

1
Go to Privileged Access Management > Accounts and select Add Account.
2
Select the Folder to add the account to. Under Account Template, select a GCP service account template, such as the default gcp-service-account template, then select Next.
3
Enter a Name for the account and the Service Account Email of the target service account, which ends in .iam.gserviceaccount.com. If the template doesn’t set a Gateway, select one under Gateway.
4
Select the Auth Method you set up. For Static Key, paste the contents of the key file into Service Account Key JSON.
5
Select Create.

​
Connect

To learn how to launch a session, see Connect to an account. The CLI command for the account is:
The CLI points gcloud at a local proxy for the session, so gcloud works without any other setup:
Press Ctrl+C to end the session. The CLI then restores your gcloud configuration.