Akun layanan adalah jenis akun khusus di Google Cloud yang memungkinkan komponen dan aplikasi sistem berinteraksi satu sama lain dan dengan API lainnya. Untuk mengetahui informasi selengkapnya tentang Google Cloud, lihat Tentang layanan Google Cloud.
Apigee hybrid menggunakan akun layanan Google Cloud untuk melakukan berbagai tugas, termasuk:
Mengirim data log dan metrik
Menarik permintaan rekaman aktivitas
Menghubungkan ke API gateway untuk permintaan API administratif
Menjalankan pencadangan
Mendownload paket proxy
Meskipun satu akun layanan dapat melakukan semua operasi ini, untuk lingkungan produksi, Apigee merekomendasikan agar Anda membuat beberapa akun layanan, yang masing-masing ditetapkan ke tugas tertentu dan masing-masing memiliki kumpulan izinnya sendiri. Hal ini meningkatkan keamanan dengan
memisahkan akses dan membatasi cakupan serta hak istimewa akses setiap akun layanan. Seperti halnya akun pengguna, izin ini diterapkan dengan menetapkan satu atau beberapa peran ke akun layanan.
Akun layanan dan peran yang digunakan oleh komponen campuran
Agar dapat beroperasi dengan benar, Apigee hybrid mengharuskan Anda membuat beberapa akun layanan. Setiap akun layanan memerlukan peran atau peran tertentu yang memungkinkannya menjalankan fungsinya.
Tabel berikut menjelaskan akun layanan untuk komponen campuran. Nama yang diberikan untuk setiap akun layanan adalah nama default. Anda dapat menggunakan nama apa pun yang diinginkan, tetapi nama tersebut harus
mudah diidentifikasi dengan tujuan setiap akun.
Komponen*
Peran
Diperlukan untuk penginstalan dasar?
Deskripsi
apigee-cassandra
Storage Object Admin roles/storage.objectAdmin
Mengizinkan pencadangan Cassandra ke Cloud Storage, seperti
yang dijelaskan dalam Pencadangan dan pemulihan.
apigee-logger
Logs Writer roles/logging.logWriter
Mengizinkan pengumpulan data logging, seperti yang dijelaskan dalam Logging. Hanya diperlukan untuk penginstalan cluster
non-GKE.
apigee-mart
Apigee Connect Agent roles/apigeeconnect.Agent
Mengizinkan autentikasi layanan MART. Peran Agen Apigee Connect memungkinkannya berkomunikasi dengan aman dengan proses Apigee Connect, seperti yang dijelaskan dalam Menggunakan Apigee Connect.
Memungkinkan sinkronisasi mendownload paket proxy dan data konfigurasi lingkungan. Juga memungkinkan pengoperasian fitur rekaman aktivitas.
apigee-udca
Agen Apigee Analytics roles/apigee.analyticsAgent
Memungkinkan transfer data status deployment, analisis, dan rekaman aktivitas ke platform manajemen.
apigee-watcher
Apigee Runtime Agent roles/apigee.runtimeAgent
Apigee Watcher mengambil perubahan terkait host virtual untuk organisasi dari sinkronisasi dan membuat
perubahan yang diperlukan untuk mengonfigurasi ingress istio.
* Nama ini digunakan dalam nama file kunci akun layanan yang didownload.
Sebagai alternatif, untuk lingkungan non-produksi, pengujian, dan demo, Anda dapat menggunakan satu akun layanan dengan semua peran yang ditetapkan. Tindakan ini tidak direkomendasikan untuk lingkungan produksi.
Selain membuat akun layanan yang tercantum dalam tabel ini, Anda akan menggunakan setiap kunci pribadi akun untuk membuat token akses sehingga Anda dapat mengakses Apigee API. Alat
create-service-account akan otomatis mendownload file kunci ke direktori
di komputer lokal Anda saat membuat atau memperbarui akun layanan.
Membuat akun layanan
Ada beberapa cara untuk membuat akun layanan, termasuk:
Alat create-service-account tersedia setelah Anda
mendownload dan memperluas apigeectl di
direktori tools/. Layanan ini membuat akun layanan khusus komponen campuran dan menetapkan
peran yang diperlukan untuk Anda. Alat ini juga otomatis mendownload kunci akun layanan dan
menyimpannya di komputer lokal Anda.
Misalnya, perintah berikut akan membuat semua akun layanan terpisah untuk
lingkungan produksi, menetapkan peran IAM yang sesuai ke setiap akun layanan, dan mendownload
setiap file kunci pribadi akun ke direktori ./service-accounts:
./tools/create-service-account --env prod
Perintah berikut membuat satu akun layanan bernama apigee-non-prod dengan semua peran IAM untuk semua komponen campuran, yang cocok untuk lingkungan demo dan pengujian, tetapi tidak untuk lingkungan produksi:
Di kolom Nama akun layanan, masukkan nama. Konsol Cloud akan mengisi kolom ID akun layanan berdasarkan nama ini.
Apigee merekomendasikan agar Anda menggunakan nama yang mencerminkan peran akun layanan; Anda
dapat menetapkan nama akun layanan agar sama dengan nama komponen yang menggunakannya.
Misalnya, tetapkan nama akun layanan Logs Writer apigee-logger.
Opsional: Di kolom Deskripsi akun layanan, masukkan deskripsi untuk akun layanan. Deskripsi membantu mengingatkan Anda tentang tujuan penggunaan akun layanan
tertentu.
Misalnya, untuk komponen logging, pilih peran Penulis Log.
Jika perlu, masukkan teks untuk memfilter daftar peran menurut nama. Misalnya, untuk hanya mencantumkan peran Apigee, masukkan Apigee di kolom filter.
Anda dapat menambahkan lebih dari satu peran ke akun layanan, tetapi Apigee merekomendasikan agar Anda hanya menggunakan satu peran untuk setiap akun layanan yang direkomendasikan. Untuk mengubah peran akun layanan setelah Anda membuatnya, gunakan halaman IAM di konsol Cloud.
Klik Lanjutkan.
Google Cloud akan menampilkan tampilan Beri pengguna akses ke akun layanan ini:
Di bagian Buat kunci (opsional), klik Buat Kunci.
Google Cloud memberi Anda opsi untuk mendownload kunci JSON atau P12:
Pilih JSON (default) dan klik Create.
Google Cloud menyimpan file kunci dalam format JSON ke komputer lokal Anda dan menampilkan konfirmasi saat
berhasil, seperti yang ditunjukkan contoh berikut:
Anda nantinya akan menggunakan beberapa kunci akun layanan untuk mengonfigurasi layanan runtime campuran.
Misalnya, saat mengonfigurasi runtime hybrid, Anda akan menentukan lokasi kunci akun layanan menggunakan properti SERVICE_NAME.serviceAccountPath.
Kunci ini digunakan oleh akun layanan untuk mendapatkan token akses, yang kemudian digunakan akun layanan untuk membuat permintaan terhadap Apigee API atas nama Anda. (Namun, hal ini belum akan terjadi dalam waktu dekat. Untuk saat ini, cukup ingat tempat Anda menyimpannya.)
Setelah selesai, Anda akan memiliki akun layanan berikut (selain akun default, jika ada):
Di konsol Google Cloud, akun layanan ditunjukkan dengan
ikon .
Setelah membuat akun layanan, jika ingin menambahkan atau menghapus peran ke akun tersebut, Anda harus menggunakan tampilan IAM & Admin. Anda tidak dapat mengelola peran untuk akun layanan di tampilan Akun layanan.
Menggunakan API pembuatan akun layanan gcloud
Anda dapat membuat dan mengelola akun layanan dengan Cloud Identity and Access Management API.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-03 UTC."],[[["\u003cp\u003eApigee hybrid utilizes Google Cloud service accounts to execute various tasks, such as sending logs, pulling trace requests, and downloading proxy bundles, which enhances security through compartmentalized access.\u003c/p\u003e\n"],["\u003cp\u003eFor production environments, Apigee recommends creating multiple service accounts, each dedicated to a specific task and equipped with its own set of permissions for better access control.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ecreate-service-account\u003c/code\u003e tool is the recommended method for creating hybrid component-specific service accounts and automatically assigns the required roles and downloads the key files, simplifying the process.\u003c/p\u003e\n"],["\u003cp\u003eService accounts can also be created via the Google Cloud console or gcloud SDK, and each service account requires specific roles to perform its function, which are detailed in the provided documentation.\u003c/p\u003e\n"],["\u003cp\u003eReusing the name of a deleted service account is discouraged and may result in unexpected behavior, so it is recommended to use a unique name when recreating service accounts.\u003c/p\u003e\n"]]],[],null,["# About service accounts\n\n| You are currently viewing version 1.8 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nA *service account* is a special type of account in Google Cloud that enables components\nand applications of a system to interact with each other and with other APIs. For more information\nabout Google Cloud, see [About Google Cloud services](/apigee/docs/hybrid/v1.8/what-is-hybrid#about-gcp).\n| **SERVICE ACCOUNT FACTOID** \n| Google Cloud projects have a limit of 100 service accounts---including the default service accounts (if any).\n\nApigee hybrid uses Google Cloud service accounts to perform a variety of tasks, including:\n\n- Send log and metrics data\n- Pull trace requests\n- Connect to API gateway for administrative API requests\n- Execute back ups\n- Download proxy bundles\n\nWhile one service account *could* perform all of these operations, for production\nenvironments Apigee recommends that you create multiple service accounts, each assigned to a\nspecific task and each with its own set of permissions. This enhances security by\ncompartmentalizing access and limiting each service account's scope and access privileges. As with\nuser accounts, these permissions are applied by assigning one or more roles to the service\naccount.\n\nService accounts and roles used by hybrid components\n----------------------------------------------------\n\nTo operate properly, Apigee hybrid requires you to create several service accounts. Each\nservice account requires a specific role or roles that enable it to perform its function.\n\nThe following table describes the service accounts for the hybrid components. The names given for\neach service account are the default names. You can use any names you want, but the names should be\neasy to identify with each account's purpose.\n\n\nAs an alternative, for nonproduction, test, and demo environments, you can use a single service\naccount with all the roles assigned to it. This is not recommended for production environments.\n\nIn addition to creating the service accounts listed in this table, you will use each accounts\nprivate keys to generate access tokens so that you can access the Apigee APIs. The\n`create-service-account` tool automaticallyl downloads the key files into a directory\non your local machine when it creates or updates the service accounts.\n\nCreate the service accounts\n---------------------------\n\n| **Deleting and recreating service accounts:** Note that reusing the name of a deleted service account may result in unexpected behavior. If you create a service account and delete it, always recreate it with a unique name. For details, see [Deleting and recreating service accounts](/iam/docs/service-account-overview#deleting-recreating).\n\nThere are several ways to create service accounts, including:\n\n- (*Recommended* ) [`create-service-account` tool](#tool)\n- [Google Cloud console](#gcp)\n- [gcloud SDK](#gcloud)\n\nEach of these is described in the following sections.\n\n### Use the `create-service-account` tool\n\nThe `create-service-account` tool is available after you\n[download and expand `apigeectl`](/apigee/docs/hybrid/v1.8/install-apigeectl) in the\n`tools/` directory. It hybrid component-specific service accounts and assigns\nthe required roles for you. The tool also automatically downloads the service account keys and\nstores them on your local machine.\n\nFor example, the following command will create all the separate individual service accounts for a\nproduction environment, assign the appropriate IAM roles to each service account, and download\neach accounts private key file to the `./service-accounts` directory: \n\n```\n./tools/create-service-account --env prod\n```\n\n\nThe following command creates a single service account named `apigee-non-prod` with all IAM\nroles for all hybrid components,\nsuitable for demo and test environments, but not for production environments: \n\n```\n./tools/create-service-account --env non-prod\n```\n\nFor more information on using `create-service-account`, see\n[create-service-account reference](/apigee/docs/hybrid/v1.8/create-service-account).\n\n### Use the Google Cloud console\n\nYou can create service accounts with the Google Cloud console.\n| **Note:** To create service accounts in the Google Cloud console, you must have the Google Cloud Service Account Admin role or greater.\n\n**To create a service account with the Google Cloud console and generate a key for the\nservice account, do the following:**\n\n1. Create a service account:\n\n 1. In the Cloud console, go to the **Service Accounts** page.\n\n [Go to\n Service Accounts](https://console.cloud.google.com/iam-admin/serviceaccounts)\n 2. Select your project.\n 3. Click add**Create Service Account**.\n 4.\n In the **Service account name** field, enter a name. The\n Cloud console fills in the **Service account ID** field based on\n this name.\n\n\n Apigee recommends that you use a name that reflects the service account's role; you\n can set the name of the service account to be the same name as the component that uses it.\n For example, set the name of the Logs Writer service account `apigee-logger`.\n\n\n For more information about the service accounts names and roles, see\n [Service accounts and roles used by hybrid components](#recommended-sas).\n 5. Optional: In the **Service account description** field, enter a description for the service account. Descriptions are helpful at reminding you what a particular service account is used for.\n 6. Click **Create and continue**.\n 7.\n Click the **Select a role** field and select a role, as described in\n [Service accounts and roles used by hybrid components](#recommended-sas). If\n the Apigee roles do not appear in the drop down list, refresh the page.\n\n For example, for the logging component, select the Logs Writer role.\n\n\n If necessary, enter text to filter the list of roles by name. For example, to list only\n the Apigee roles, enter `Apigee` in the filter field.\n\n\n You can add more than one role to a service account, but Apigee recommends that\n you only use one role for each of the recommended service accounts. To change the roles of\n a service account after you have created it, use the **IAM**\n page in the Cloud console.\n | **Note:** If you do not see the roles listed in [Recommended service accounts](#recommended-sas), check with your Apigee account representative to be sure that your account was properly configured and that your organization was provisioned.\n 8. Click **Continue** .\n\n Google Cloud displays the **Grant users access to this service account** view:\n\n 9. Under **Create key (optional)** , click **Create Key** .\n\n Google Cloud gives you the option to download a JSON or P12 key:\n\n 10. Select JSON (the default) and click **Create** .\n\n Google Cloud saves the key file in JSON format to your local machine and displays a confirmation when\n it is successful, as the following example shows:\n\n You will later use some of the service account keys to configure hybrid runtime services.\n For example, when you configure the hybrid runtime, you will specify the location of the service\n account keys using the \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e`.serviceAccountPath` properties.\n\n These keys are used by the service accounts to get access tokens, which the service account\n then uses to make requests against the Apigee APIs on your behalf. (But that's not for a while\n yet; for now, just remember where you saved it.)\n 11. Repeat steps 4 through 11 for each service account listed in [Service accounts and roles used by hybrid components](#recommended-sas) (except the `apigee-mart` account---which has no role associated with it---so do not assign it a role).\n\n When you're finished, you should have the following service accounts (in addition to the\n defaults, if any):\n\n\n In the Google Cloud console, service accounts are indicated with the\n icon.\n\n After you create a service account, if you want to add or remove a role to it, you must use\n the **IAM \\& Admin** view. You cannot manage roles for service accounts in the\n **Service accounts** view.\n | **Tip:** Apigee hybrid includes a validator that checks your service accounts' key files and permissions when [apigeectl](/apigee/docs/hybrid/v1.8/cli-reference) applies the Apigee hybrid runtime components to your cluster. This validation is enabled by default. For more information, see [Service account\n | validation](/apigee/docs/hybrid/v1.8/sa-validation).\n\n ### Use the gcloud service account creation APIs\n\n You can create and manage service accounts with the Cloud Identity and Access Management API.\n\n For more information, see\n [Creating\n and managing service accounts](/iam/docs/creating-managing-service-accounts).\n\n Troubleshooting\n ---------------\n\n | **Deleting and recreating service accounts:** Note that reusing the name of a deleted service account, may result in unexpected behavior. If you create a service account and delete it, always recreate it with a unique name. For details, see [Deleting and recreating service accounts](/iam/docs/service-account-overview#deleting-recreating)."]]
.