[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[],[],null,["# Configure permissions on target project service account\n\nMigrate to Virtual Machines creates a default service account when you enable the\nMigrate to Virtual Machines API on the host project.\n\nTo be able to assign the service account used to run a Compute Engine instance\non a target project, you must add the necessary permissions to the\nMigrate to Virtual Machines default service account.\n\nAbout the service account used to run a Compute Engine instance\n---------------------------------------------------------------\n\nBefore you can test-clone or cut-over a VM, you must configure the target\ndetails of the [Compute Engine](/compute/docs/how-to) instance used to host\nthe migrated VM. For both a test and a production environment, configure the\ntarget details for the Compute Engine instance to specify:\n\n- Google project\n- Number of CPUs\n- Amount of memory\n- Disk size\n\nFor example, you have the following environment:\n\n- Project A - Migrate to Virtual Machines **host** project\n- Project B - Compute Engine **target** project\n\nBy default, the Compute Engine instance running on target Project B\ndoes not have a service account assigned to it.\n\nIf the target Compute Engine instance requires access to\nGoogle Cloud services and APIs, [create a service account](/compute/docs/access/create-enable-service-accounts-for-instances#createanewserviceaccount) in the\ntarget project with the necessary permissions to access those services and APIs.\nThen, assign that service account to the Compute Engine instance when you\n[configure its target details](/migrate/virtual-machines/docs/5.0/migrate/migrating-vms#configure-target).\n\nYou perform all configuration of Compute Engine instances from the\nMigrate to Virtual Machines host project. Before you can assign a service account in\nthe target project to aCompute Engine instance, you must ensure that the\nMigrate to Virtual Machines default service account has the necessary permissions on\nthe target service account.\n\nConfiguring the default service account\n---------------------------------------\n\nTo assign a service account to a [Compute Engine](/compute/docs/how-to)\ninstance running on a **target** project, the default Migrate to Virtual Machines\nservice account on the **host** project must be added to the `Service Account User`\nrole on the target service account.\n\n**To add the default service account to the Service Account User role:**\n\n1. Determine the email address of the Migrate to Virtual Machines default service\n account:\n\n 1. Open the Migrate to Virtual Machines page in the Google Cloud console:\n\n [Go to the Migrate to Virtual Machines page](https://console.cloud.google.com/compute/mfce)\n 2. Select the **Targets** tab.\n\n At the top of the page is an information box showing the email address of\n the Migrate to Virtual Machines default service account in the form:\n\n `service-`\u003cvar translate=\"no\"\u003eHOST_PROJECT_NUMBER\u003c/var\u003e`@gcp-sa-vmmigration.iam.gserviceaccount.com`\n 3. Save that email address for use below.\n\n2. In the Google Cloud console, go to the **Service Accounts** page.\n\n [Go to the Service Accounts page](https://console.cloud.google.com/iam-admin/serviceaccounts)\n3. Select the **target** project.\n\n4. Select the checkbox next to the chosen **target** service account.\n\n5. Click **Manage Access**.\n A list of roles that have been granted on the service account are displayed.\n\n6. Expand the **Service Account User** role to view the principals\n that have been granted that role on the service account.\n\n7. If the email address of the Migrate to Virtual Machines default service account is\n not listed, select **Add Principal**.\n\n8. Enter the email address of the Migrate to Virtual Machines default service account\n as the **New principal**.\n\n9. Select the **Service Accounts \\\u003e Service Account User** role.\n\n10. Select **Save**.\n\n You should now be able to assign the service account to a\n [Compute Engine](/compute/docs/how-to) instance running on a **target** project."]]
