（仅适用于 UDCA 和同步器）如果对项目的权限检查失败，验证会继续根据 Apigee 环境的 IAM 政策检查权限。这些 SA 的范围为环境，且环境支持更精细的权限。
如需更新特定环境的 IAM 政策，请转到 Hybrid 界面。转到管理 > 环境 > 访问权限
例如，以下是一个失败的权限检查的错误消息：
Invalid Metrics Service Account. Service Account
"apigee-metrics@hybrid-project.iam.gserviceaccount.com" is missing 1 or more required
permissions [monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.create].
Visit Service accounts and roles used by
hybrid components for more details on setting up Apigee hybrid service account permissions.
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-26。"],[[["\u003cp\u003eThis documentation is for Apigee hybrid version 1.3, which is end-of-life, and users should upgrade to a newer version.\u003c/p\u003e\n"],["\u003cp\u003eApigee hybrid includes a service account validation feature enabled by default, that ensures correct key locations and proper permissions in the GCP project.\u003c/p\u003e\n"],["\u003cp\u003eTo enable validation of the service account's permissions, the Cloud Resource Manager API must be enabled in the GCP project, and the \u003ccode\u003evalidateServiceAccounts\u003c/code\u003e property must be set to \u003ccode\u003etrue\u003c/code\u003e in the overrides file.\u003c/p\u003e\n"],["\u003cp\u003eService account JSON key format validation is always performed and cannot be disabled, while permission validation can be turned off by setting \u003ccode\u003evalidateServiceAccounts\u003c/code\u003e to \u003ccode\u003efalse\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eService account permission validation checks permissions first on the project ID and, if that fails, proceeds to check permissions against the Apigee environment's IAM policy for UDCA and Synchronizer components.\u003c/p\u003e\n"]]],[],null,["# Service account validation\n\n| You are currently viewing version 1.3 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nApigee hybrid provides validation that ensures the location of your service accounts' keys\nare correct and that the accounts have the proper permissions in your GCP project. This validation\nis enabled by default.\n\nThis section describes how to enable or disable service account validation. In addition, this\nstep ensures that you have the proper APIs enabled for your GCP project so that validation\nworks.\n\nEnable service account permission validation\n--------------------------------------------\n\n**To enable permission validation:**\n\n1. Be sure the [Cloud Resource Manager API](https://cloud.google.com/resource-manager/reference/rest/) is enabled for your GCP project:\n 1. Open the [Google Cloud console](https://console.cloud.google.com) and log in with the account you created in [Step 1: Create a Google Cloud account](/apigee/docs/hybrid/v1.3/precog-gcpaccount).\n 2. Select the project that you created in [Step 2: Create a Google Cloud project](/apigee/docs/hybrid/v1.3/precog-gcpproject).\n 3. Select **APIs \\& Services \\\u003e Library**.\n 4. Search for \"Cloud Resource Manager\".\n 5. Locate the **Cloud Resource Manager API** service and click on it.\n 6. If it is not enabled, click **Enable**.\n\n You can also enable the API using gcloud: \n\n ```\n gcloud services enable cloudresourcemanager.googleapis.com --project GCP_project_ID\n ```\n2. In your overrides file, add the `validateServiceAccounts` property and set it to `true`. For example: \n\n ```text\n ...\n # Enables strict validation of service account permissions.\n validateServiceAccounts: true\n ...\n ```\n\nWhen validation is enabled, any time [apigeectl](/apigee/docs/hybrid/v1.3/cli-reference) applies the\nApigee hybrid runtime components to your cluster, it validates the\n[service account](/apigee/docs/hybrid/v1.3/precog-serviceaccounts) keys that are included in your overrides\nfile.\n| **NOTE:** Service account JSON key format validation is always performed. You do not have to take any steps to enable this validation and you cannot disable it.\n\nTroubleshooting validation errors\n---------------------------------\n\n| **Deleting and recreating service accounts:** Note that reusing the name of a deleted service account may result in unexpected behavior. If you create a service account and delete it, always recreate it with a different name than the original SA. For details, see [Deleting and recreating service accounts](https://cloud.google.com/iam/docs/service-account-overview#deleting-recreating).\n\nIf validation fails, the runtime deployment stops and `apigeectl` exits.\nTo troubleshoot service account failure, it's helpful to know that validation checks\npermissions in this order:\n\n1. Permission on the project ID.\n2. (For UDCA and Synchronizer only) If the permission check on the project fails, validation proceeds to check permission against the Apigee environment's [IAM policy](/apigee/docs/reference/apis/apigee/rest/v1/organizations.environments/setIamPolicy). These SAs are environment scoped and environments support finer-grained permissions.\n\n\n To update the IAM policy for a specific environment, go to the hybrid UI. Go to\n **Admin \\\u003e Environments \\\u003e Access**\n\n\nFor example, the following is an error message for a failed permission check: \n\n```\nInvalid Metrics Service Account. Service Account\n\"apigee-metrics@hybrid-project.iam.gserviceaccount.com\" is missing 1 or more required\npermissions [monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list\nmonitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.create].\nVisit Service accounts and roles used by\nhybrid components for more details on setting up Apigee hybrid service account permissions.\n```\n\n\nTo address this error, add the required roles to the service account. For\ninformation on creating and modifying service accounts, see [Create the service accounts](/apigee/docs/hybrid/v1.3/sa-about#create-the-service-accounts). To check the required permissions for each Apigee hybrid component, see\n[Service accounts and roles used by hybrid components](/apigee/docs/hybrid/v1.3/sa-about#recommended-sas).\n\nDisable permission validation\n-----------------------------\n\nTo disable service account permission validation, set the `validateServiceAccounts`\nproperty in your overrides file to `false`, as the following example shows: \n\n```text\n...\n# Enables strict validation of service account permissions.\nvalidateServiceAccounts: false\n...\n```"]]
