Stay organized with collections
Save and categorize content based on your preferences.
Looker (Google Cloud core) uses a service agent, called a Looker service account, to perform certain activities. A single Looker service account works on behalf of all Looker (Google Cloud core) instances in a given Google Cloud project. The Looker service account is automatically created the first time a Looker (Google Cloud core) instance is created in a project.
The service account allows Looker (Google Cloud core) to connect to other services, such as BigQuery.
Or, if you are planning to use CMEK and are going to use the Google Cloud CLI, Terraform, or the API to configure CMEK before you create the Looker (Google Cloud core) instance, you must create the Looker service account manually before you create the instance.
To view or create the Looker service account, select one of the following options:
console
To view the Looker service account:
In the Google Cloud console, go to the IAM page.
Go to IAM
Select the project that the Looker (Google Cloud core) instance resides in.
Select the Include Google-provided role grants checkbox.
Replace PROJECT_ID with the project that the Looker (Google Cloud core) instance resides in.
The service account name will be Looker Service Account. The email will have the format service-<project number>@gcp-sa-looker.iam.gserviceaccount.com.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[],[],null,["Looker (Google Cloud core) uses a [service agent](/iam/docs/service-account-types#service-agents), called a *Looker service account*, to perform certain activities. A single Looker service account works on behalf of all Looker (Google Cloud core) instances in a given Google Cloud project. The Looker service account is automatically created the first time a Looker (Google Cloud core) instance is created in a project.\n\nThe service account allows Looker (Google Cloud core) to connect to other services, such as [BigQuery](/looker/docs/looker-core-dialects#using-application-default-credentials-to-connect-to-a).\n\nSometimes, such as when you're using [Application Default Credentials (ADC) with a connection to BigQuery in another project](/looker/docs/looker-core-dialects#adc-different-project), you need to view information about the Looker service account, such as its email address.\n\nOr, if you are planning to use [CMEK](/looker/docs/looker-core-cmek) and are going to use the Google Cloud CLI, Terraform, or the API to configure CMEK before you create the Looker (Google Cloud core) instance, you must create the Looker service account manually *before* you create the instance.\n| **Note:** You need to manually create a Looker service account only if you use the Google Cloud CLI, Terraform, or the API to configure CMEK and a Looker service account hasn't already been created for your project.\n\nTo view or create the Looker service account, select one of the following options: \n\nconsole\n\nTo view the Looker service account:\n\n1. In the Google Cloud console, go to the **IAM** page.\n\n \u003cbr /\u003e\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam)\n2. Select the project that the Looker (Google Cloud core) instance resides in.\n3. Select the **Include Google-provided role grants** checkbox.\n\ngcloud\n\nTo create or view the Looker service account: \n\n```\n\ngcloud beta services identity create --service=looker.googleapis.com --project=PROJECT_ID\n\n```\n\nReplace \u003cvar translate=\"no\"\u003e\u003ccode translate=\"no\" dir=\"ltr\"\u003ePROJECT_ID\u003c/code\u003e\u003c/var\u003e with the project that the Looker (Google Cloud core) instance resides in.\n\nThe service account name will be `Looker Service Account`. The email will have the format `service-\u003cproject number\u003e@gcp-sa-looker.iam.gserviceaccount.com`."]]
