Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Untuk mengakses resource Google Cloud , instance virtual machine (VM) Compute Engine menggunakan akun layanan. Jika Anda
secara tidak sengaja menghapus
akun layanan default Compute Engine,
aplikasi yang berjalan di VM Anda mungkin tidak dapat melakukan panggilan ke
Google Cloud API.
Dokumen ini menjelaskan cara memulihkan akun layanan default Compute Engine setelah dihapus.
Memulihkan akun layanan default Compute Engine
Saat Anda menghapus akun layanan, Identity and Access Management (IAM)
akan menghapus akun layanan secara permanen setelah 30 hari. Jika Anda tidak sengaja
menghapus akun layanan
default Compute Engine, Google Cloud tidak dapat memulihkan akun layanan
setelah dihapus secara permanen dan VM tidak akan lagi memiliki akses ke
resource dalam project. Dalam kasus seperti itu, jika Anda ingin menetapkan akun layanan default Compute Engine untuk VM, buat akun layanan dan tetapkan sebagai akun layanan default.
Untuk mendapatkan izin yang
Anda perlukan untuk melakukan tugas ini,
minta administrator Anda untuk memberi Anda
peran IAM berikut di project Anda:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-19 UTC."],[[["\u003cp\u003eCompute Engine VMs rely on service accounts, including a default one, to access Google Cloud resources.\u003c/p\u003e\n"],["\u003cp\u003eDeleting the Compute Engine default service account can prevent VMs from accessing Google Cloud APIs, and after 30 days Google can no longer recover the service account.\u003c/p\u003e\n"],["\u003cp\u003eIf the default service account was deleted within 30 days, it can be recovered using the \u003ccode\u003eundelete\u003c/code\u003e command, but if it was deleted longer than 30 days ago, then it is permanently removed.\u003c/p\u003e\n"],["\u003cp\u003eIf the default service account is permanently removed, you must create or select an existing service account to set as the new default, then assign the new service account to the desired VMs.\u003c/p\u003e\n"],["\u003cp\u003eTo perform this task, your admin needs to grant you the Compute Admin and Logs Viewer IAM roles on your project, or you may get the needed permissions through custom or other predefined roles.\u003c/p\u003e\n"]]],[],null,["# Troubleshooting default service accounts\n\n*** ** * ** ***\n\nTo access Google Cloud resources, Compute Engine virtual\nmachine (VM) instances use\n[service accounts](/iam/docs/service-account-overview). If you\naccidentally delete the\n[Compute Engine default service account](/compute/docs/access/service-accounts#default_service_account),\napplications that run on your VMs might not be able to make calls to\nGoogle Cloud APIs.\n\nThis document explains how to recover the Compute Engine default service\naccount after it is deleted.\n\nRecover the Compute Engine default service account\n--------------------------------------------------\n\nWhen you delete a service account, Identity and Access Management (IAM)\npermanently removes the service account after 30 days. If you accidentally\ndelete the Compute Engine\ndefault service account, Google Cloud cannot recover the service account\nafter it is permanently removed and then the VMs will no longer have access to\nresources in the project. In such cases, if you want to assign a\nCompute Engine default service account for the VM, create a service account\nand set it as the default service account.\n\n\nTo get the permissions that\nyou need to perform this task,\n\nask your administrator to grant you the\nfollowing IAM roles on your project:\n\n- [Compute Admin](/iam/docs/roles-permissions/compute#compute.admin) (`roles/compute.admin`)\n- [Logs Viewer](/iam/docs/roles-permissions/logging#logging.viewer) (`roles/logging.viewer`)\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nTo recover a deleted Compute Engine default service account, do the following:\n\n1. In the Google Cloud console, go to the **Logs Explorer** page.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n\n Use the following query to validate when the Compute Engine default service\n account was deleted: \n\n ```\n resource.type=\"service_account\"\n protoPayload.methodName=\"google.iam.admin.v1.DeleteServiceAccount\"\n \"PROJECT_NUMBER-compute@developer.gserviceaccount.com\"\n ```\n\n Replace \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e with the project number of your\n project.\n\n **If the default service account was deleted less than 30 days ago**:\n\n Use the `undelete` command to recover the service account. For more\n information, see [Undelete a service\n account](/iam/docs/service-accounts-delete-undelete#undeleting).\n\n **If the default service account was deleted more than 30 days ago**:\n 1. [Create a service account](/iam/docs/service-accounts-create#creating) or select an existing service account to set as the new Compute Engine default service account.\n2. If you want VMs to use the newly created default service account, [follow these\n steps](/compute/docs/instances/change-service-account#changeserviceaccountandscopes):\n\n 1. Go to the **VM instances** page.\n\n [Go to VM instances](https://console.cloud.google.com/compute/instances)\n 2. Click the VM instance name for which you want to use the service account.\n\n 3. If the VM is running, click stop **Stop**\n to stop the VM. If there is no **Stop** option, click\n more_vert **More actions \\\u003e** stop **Stop**.\n\n 4. Click **Edit**.\n\n 5. Scroll down to the **Service Account** section.\n\n 6. From the drop-down list, select the service account to assign to the\n instance."]]
