[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-11。"],[],[],null,["# Cloud Workstations service accounts\n\nThis page describes the service accounts created and managed by\nCloud Workstations. Cloud Workstations creates two service\naccounts:\n\n- [Cloud Workstations Service Agent](#workstations-service-agent)\n- [Cloud Workstations VM Default Service Account](#default_service_account)\n\nGoogle owns these accounts, but they are specific to your project. They are\ndeleted only when you delete your project. You might encounter service\ndisruptions if you change the permissions granted to these service accounts.\n\n### Cloud Workstations Service Agent\n\nThe Cloud Workstations Service Agent uses the following email format: \n\n```\nservice-PROJECT_NUMBER@gcp-sa-workstations.iam.gserviceaccount.com\n```\n\nThis service agent allows Cloud Workstations to\nperform service duties on your project. By default, this service agent is\nautomatically granted the Workstations Service Agent (`roles/workstations.serviceAgent`)\nIAM role on your project.\n\nRevoking or changing the permissions for this service agent prevents\nCloud Workstations from accessing the compute and network resources\nthat back your workstations. To avoid service disruptions, don't modify the\nservice agent's permissions.\n\n### Cloud Workstations VM Default Service Account\n\nWorkstations are hosted on Compute Engine instances. When you create a\nworkstation, you can specify a service account to attach to the underlying\nCompute Engine instance. If you don't specify a service account, the\nCloud Workstations VM Default Service Account for your project is used.\n\nThe Cloud Workstations VM Default Service Account uses the following email format: \n\n```\nservice-PROJECT_NUMBER@gcp-sa-workstationsvm.iam.gserviceaccount.com\n```\n\nUsing the Cloud Workstations VM Default Service Account has the\nfollowing limitations:\n\n- [Cloud Workstations container output logging](/workstations/docs/container-output-logging) is not supported.\n- [Impersonating a service account](/workstations/docs/authentication#impersonate-a-service-account) is not supported.\n- You cannot use `ssh` to connect to the VM assigned to the workstations that use this configuration.\n\nTo avoid these limitations, you can specify a service account on your\nworkstation configuration. For more information, see\n[Customize the environment](/workstations/docs/create-configuration#customize_environment).\n\nWhat's next\n-----------\n\n- [Authenticate and setup API access within a workstation](/workstations/docs/authentication).\n- [Access control with IAM](/workstations/docs/access-control)."]]
