[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[[["\u003cp\u003eService account impersonation allows an authenticated principal to assume the identity of a service account, granting access based on the service account's permissions, without the need of a service account key.\u003c/p\u003e\n"],["\u003cp\u003eImpersonating service accounts enhances security because it requires prior authentication and generates short-lived credentials that do not persist, unlike service account keys which pose a higher risk if exposed.\u003c/p\u003e\n"],["\u003cp\u003eTo impersonate a service account, the authenticated principal must have the \u003ccode\u003eroles/iam.serviceAccountTokenCreator\u003c/code\u003e role and the Service Account Credentials API must be enabled.\u003c/p\u003e\n"],["\u003cp\u003eService account impersonation can be used with the gcloud CLI, either for individual commands using the \u003ccode\u003e--impersonate-service-account\u003c/code\u003e flag, or globally, by setting \u003ccode\u003eauth/impersonate_service_account\u003c/code\u003e config property, or to create Application Default Credentials (ADC) for client libraries in multiple languages.\u003c/p\u003e\n"],["\u003cp\u003eGenerating short-lived credentials is a required alternative for situations where other methods are not suitable, such as if you need a different credential type or in a production environment.\u003c/p\u003e\n"]]],[],null,["# Use service account impersonation\n\nWhen the principal you are using doesn't have the permissions you need to\naccomplish your task, or you want to use a service account in a development\nenvironment, you can use *service account impersonation*.\n\nWhen you use service account impersonation, you start with an authenticated\nprincipal (your user account or a service account) and request short-lived\ncredentials for a service account that has the authorization that your use case\nrequires. The authenticated principal must have the\n[necessary permissions](#required-roles) to impersonate the service account.\n\nService account impersonation is more secure than using a service account key\nbecause service account impersonation requires a prior authenticated identity,\nand the credentials that are created by using impersonation do not persist.\nIn comparison, authenticating with a service account key requires no prior\nauthentication, and the persistent key is a high risk credential if exposed.\n\nFor more information about service account impersonation, see\n[Service account impersonation](/iam/docs/service-account-impersonation).\n\nBefore you begin\n----------------\n\nBefore you use service account impersonation, you need to enable the required\nAPIs and ensure that you have the required roles.\n\n### Enable APIs\n\nTo impersonate a service account, you need to enable the\nService Account Credentials API in your project.\n\n\n[Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=iamcredentials.googleapis.com)\n| **Note:** If you're using the Google Cloud CLI, ensure that this API is enabled in the project that you're operating in.\n\n### Required roles\n\n\nTo get the permission that\nyou need to impersonate a service account,\n\nask your administrator to grant you the\n\n\n[Service Account Token Creator](/iam/docs/roles-permissions/iam#iam.serviceAccountTokenCreator) (`roles/iam.serviceAccountTokenCreator`)\nIAM role on the service account.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nThis predefined role contains the\n` iam.serviceAccounts.getAccessToken`\npermission,\nwhich is required to\nimpersonate a service account.\n\n\nYou might also be able to get\nthis permission\nwith [custom roles](/iam/docs/creating-custom-roles) or\nother [predefined roles](/iam/docs/roles-overview#predefined).\n\nYou must grant these roles to your account, even when you are working in a\nproject that you created.\n\nFor more information about roles required for impersonation, see\n[Roles for service account authentication](/iam/docs/service-account-permissions#directly-impersonate).\n\nYou can use service account impersonation using the following methods:\n\n- [Use the gcloud CLI](#gcloud)\n- [Set up Application Default Credentials for using client libraries](#adc)\n- [Generate and manage short-lived credentials](#short-lived-creds)\n\nUse the gcloud CLI\n------------------\n\nThe gcloud CLI provides a straightforward way to use service account\nimpersonation. This method works well when you need to use a service account\nto access Google Cloud resources or services by using the\ngcloud CLI.\n\nYou can impersonate a service account for a specific gcloud CLI\ncommand or set up the gcloud CLI to use impersonation for every\ncommand automatically.\n\n### Use impersonation for a specific gcloud CLI command\n\nTo use impersonation for a specific gcloud CLI command, you use the\n[`--impersonate-service-account` flag](/sdk/gcloud/reference#--impersonate-service-account). For example, the\nfollowing command lists storage buckets, using the identity and access provided\nby the specified service account: \n\n gcloud storage buckets list --impersonate-service-account=\u003cvar translate=\"no\"\u003eSERVICE_ACCT_EMAIL\u003c/var\u003e\n\nWhen you use this flag, the gcloud CLI requests short-lived\ncredentials for the specified service account and uses them to authenticate\nto the API and authorize the access. The principal that is logged in to the\ngcloud CLI (usually your user account) must have the required\npermission on the service account.\n\n### Use impersonation with the gcloud CLI by default\n\nTo set up the gcloud CLI to use the identity and access provided by\na service account by default, you use the\n[gcloud CLI config command](/sdk/gcloud/reference/config): \n\n gcloud config set auth/impersonate_service_account \u003cvar translate=\"no\"\u003eSERVICE_ACCT_EMAIL\u003c/var\u003e\n\nWith this config property set, the gcloud CLI requests short-lived\ncredentials for the specified service account and uses them to authenticate\nto the API and authorize the access to the resource for every command.\nThe principal that is logged in to the gcloud CLI must have the\nrequired permission on the service account.\n\nSet up Application Default Credentials for using client libraries\n-----------------------------------------------------------------\n\n\nYou can use service account impersonation to set up a local Application Default\nCredentials (ADC) file. Client libraries that support impersonation\ncan use those credentials automatically. Local ADC files created by using\nimpersonation are supported in the following languages:\n\n- C#\n- Go\n- Java\n- Node.js\n- Python\n\n\nUse service account impersonation to create a local ADC file: \n\n```\ngcloud auth application-default login --impersonate-service-account SERVICE_ACCT_EMAIL\n```\n\n\nYou can now use client libraries using the supported languages the same way you would after\nsetting up a local ADC file with user credentials. Credentials are automatically found by the\nauthentication libraries. For more information, see\n[Authenticate for using client libraries](/docs/authentication/client-libraries).\n\n\nCredentials from a local ADC file generated by using service account impersonation are not\nsupported by all of the authentication libraries. For more information, see\n[Error returned for local credentials from service account impersonation](/docs/authentication/troubleshoot-adc#local-impersonated).\n\n\u003cbr /\u003e\n\nGenerate and manage short-lived credentials\n-------------------------------------------\n\nIf neither of the previous methods address your use case, you need to\ngenerate and manage short-lived tokens. For example, if you need a different\ntype of short-lived credential (something other than an access token), or if\nyou need to use impersonation in a production environment, use this method.\n\nFor information about generating short-lived tokens, see\n[Create short-lived credentials for a service account](/iam/docs/create-short-lived-credentials-direct).\n\nWhat's next\n-----------\n\n- Learn more about [how ADC finds credentials](/docs/authentication/application-default-credentials).\n- Explore [authentication methods](/docs/authentication)."]]
