Cross project management using service account

Question

I need a service account that can access multiple projects, but I have not been able to find a way to do this at all. It seems that a service account is always bound to a project.

Another option is to create a service account on the separate projects and then authenticate them using gcloud auth activate-service-account --key-file SOME_FILE.json, but the problem here is that it does not seem possible to automate the creation of service accounts.

So the question is then: Is it possible to create a cross project service account or to automate the creation of a service accounts? Even better would be if I could do both

Answer 1

A service account should be able to be added to another project:

In the Cloud Console, create the first service account for project A. Using gcloud auth activate-service-account, turn it on.

Navigate to project B in the Cloud Console. Go to "IAM & admin" > "IAM" to find the "IAM" page. Select "Add" from the drop-down menu. Paste the name of the service account (it should appear like a funny email address) and assign it the proper role in the "New members" column.

Run gcloud scripts with project B as the —project parameter. They should be successful (I just manually verified that this will work).

We're hesitant to automate the establishment of service accounts until we've thoroughly investigated the security implications.