Service Accounts in Google Cloud - IAM in GCP.

[@Afdac247]

For people to find this Better you should use "using Google apis with your external app" this will save a lot of people time I had no idea what a service account is until I had to dig in the docs

[@lizamiller5561]

Oh my god. I love you . Hands down the great explanation . I was struggling a lot with this concept , please make more videos .

[@CloudAdvocate]

Thank you 😊

[@vamsikrishnag1417]

This video helped me a lot to learn in-depth of service account. Thanks GK.

[@jagdishbelapure7521]

I tried multiple online courses (Udemy, LA, coursera ..etc) on GCP ACE, but this is far better than any other course/content, thank you so much !! :)

[@CloudAdvocate]

Thank you Jagdish!! I appreciate it.

[@AniruddhaSinharokzzz]

You explained things in a very composed way keeping best practices in mind!

[@CloudAdvocate]

Thanks mate.

[@adamtechdays]

thank you sir, you have clarified service accounts clearly here!

[@bhattbhavesh91]

Thank you :) Very well explained :)

[@thatisrikanth7524]

Thanks GK, I cleared my doubt by watching your video, its clear, In aws it does not have all this scrap it has neat way like IAM role policy and the group thats it here in gcp it has lot of confusion things

[@CloudAdvocate]

True Srikanth, I completely agree with you. IAM in AWS is very strong it is partly because the way AWS account structure is organized. GCP tackles it in a different way, it expects the segregation happens at Org, folder and project level...may be thats why IAM stuff is very limited.

[@pratikbhandari5649]

Very clean and perfect demo.. thanks alot.. you saved my day

[@CloudAdvocate]

You're welcome!

[@abhilashshetty4840]

Thank you for this GK.. Great lecture and keep the rhythm on to inspire others.. we need More classes 🙂

[@CloudAdvocate]

Thank you, I will

[@comradeiyer1898]

Great demo. Simple and structured presentation.

[@easy-waytolearn4118]

Thank you very much, very simple and nice explanation, easy to understand. Please make more videos on gcp.

[@CloudAdvocate]

Thank you, I will

[@Summersolt]

Thanks for this. How do we modify the role of an existing service account?

[@SowjiSreeni]

Thanks! you may missed to add scenario of "edit the instance and add or update service account"?

[@ravivenkatatejamucharla1802]

Excellent demo..kudos to you

[@Mem-qv7fh]

Very good explaination thanks a lot

[@subesingh7285]

very good explanation and demo. Thanks!

[@CloudAdvocate]

You are welcome!

[@faisalraj6654]

For instance 4, I did not see you creating SSH key or are you using public Key that you have defined in META DATA in previous video?. Is the public key defined in the Meta Data is at the Project level? Meaning, all the VM that are being created within the project uses this Meta data key?

[@omkarnadkarni4765]

Thank you for the nice explanation

[@hakhandare]

Good explanation, Thanks!!!

[@kenguie]

This is the first video I have seen from you. I really like your cadence and your clarity. Question - I am a frontend (some backend) dev and I need to learn Google Cloud and Big Query well. Most likely before the end of the year. What can I do to learn both topics in the most efficient way possible? Not for a google exam but for working with our data scientist and outside services? (Which is why i was looking for videos on service accounts) - Probably too broad a question, any insight and guidance is appreciated, thanks!

[@meuko]

It's been a year, but I guess for other people reading your comment; the best way of learning is doing it (duh, hear me out), and specifically looking for resources that explain it well. Truth be told, I don't really learn well with the google docs, usually too vague. Not many people take the opportunity to make use of the free 300 bucks google-cloud credits, claim it and just go to town with the services. If you're a visual learner, use videos to guide you on whatever topic it is that you're dealing with at that moment. For me personally, I learn best from reading, so I just downloaded a bunch of PDF books on docker/ kubernetes/ terraform etc. and just used their google-cloud section as a reference. Some books have great diagrams/ illustrations to drive the point home. There are a few books which I have besides my desktop which I always use for reference. Try and find your reference books. Also) funny that you mention, but there are also specifically books and pamplets for people studying for the google cloud operator exams, one I used in the past, just to get my projects up and running is "Official Google Cloud Certified Professional Cloud Architect Study Guide" by Dan Sullivan. All in all, if you're not applying what you've read, you'll literally forget it within the hour, you have to apply this knowledge.

[@itgurukul]

🙏🙏🙏 You are super

[@harish5308]

Awesome video, 👌

[@TradingGuide]

Thank you, great demo.

[@vishal24121]

Very nicely explained

[@CloudAdvocate]

Thanks Vishal.

[@gcpchannelforbegineers7080]

Sir I have one doubt. You have created one service account and that has role of storage object viewer and creater role. Later you assigned this SVC while creation of VM. My concern while copying the files why it is getting error bcoz already we give the roles of it. I'm thinking that storage object creater role means makes a bucket , copy a bucket and etc. Can you explain plz?

[@Hummingbird314]

Can you put a demo on using Workload Identity, which is the recommended way of accessing Google Cloud APIs from pods, instead of service accounts?

[@SaiDileepfantasy]

You created service account but you did not login with it to compute instance, may I know why?

[@vaishalism]

Really great content ..thank u so much..I have one query..I want to do certification in associate cloud engineer for gcp..can u guide me about how to prepare for the same..thanks

[@mukhtarali9476]

Thanks you for this video

[@aka251277]

Thank you . This is good info. Can a default service account of a VM can create a storage object by default? Usually a default service account will have a project editor role right? In that case, it should have the permission to create the object by default correct ?

[@CloudAdvocate]

Actually default service account of VM shouldn't have project editor if I remember correctly..it has object permissions but you can change that while creating the VM or even later.

[@shashankraj800]

Hi, Can we use google service account to implement/use google maps APIs. If yes, please suggest how to do or provide a reference link. Thanks...

[@debasishsaha3235]

Thank you for the video. I just got a query, you associated service account named "demoaccount" on the instance-4 but you logged in as "gkrishna25" into same. Does it mean the roles associated with the service account distributed as instance level as well?

[@satelliteinc.6767]

Wait, why aren't you allowed to create a bucket? I thought you defined the service account as GS Object Creator?

[@CloudAdvocate]

Yes coz you need bucket creator for that.

[@sohamdhodapkar2813]

Hey GK, awesome content! I have my exam next week and your videos are really helpful. Do you have similar notes for all the other chapters too? They can go a long way when doing revisions. Thanks!

[@CloudAdvocate]

Hi Soham, I recommend going through my learn gcp Playlist.

[@praveshtiwari6449]

I am trying to deploy a software using kubernetes. everything went well ...but when i am trying to access it . it's showing "default backend - 404" in browser.

[@jayapalreddyvanam5623]

Hi GK Thanks for the great work you are doing. Could you please help to explain how can we provide privileges to a service account for a particular period of time .

[@CloudAdvocate]

I am not sure actually you can do that directly. You might want to use vault or other services to control that. Or you might want to write custom automation to control that.

[@joeb.1163]

Thank you very much.

[@CloudAdvocate]

You are welcome!

[@johnflowers4487]

Hello! First off, thank you for the informative video. Is there a permission to overwrite existing objects in a storage bucket (without giving full storage permission)? For example, I'm writing a script that will pull from an API and save it to a google cloud storage bucket and it would be helpful if i could overwrite the same file each time. Tried googling and am a bit new to GCP - sorry for the simplistic question.

[@CloudAdvocate]

Hi John, for this operation I guess you can just use storage.objects.create and try it out.

[@johnflowers4487]

@@CloudAdvocate Will do, thank you

[@mohammedmustafaali1049]

very lovely videos, thanks very much. what is meant by the scope in 14:42?

[@CloudAdvocate]

Access scopes define the default OAuth scopes for requests made through the client libraries and gcloud.

[@anandharajrangasamyigcb6137]

Hi GK, How to add scope to existing GKE nodes. Please share your input thank you.

[@eshanikabhattacharjee383]

from where do i get the service accouut credentials?

[@balamungala8975]

i need your help to install php app and connect to mysql on google cloud.

[@hakhandare]

What happens when we enable scope for Cloud Sql in vm default service account?

[@udayvadher6414]

Can we use a Service Account as a replication user of CloudSQL?

[@prudhvirajboddu6304]

hey GK, can we edit the permissions for a service account once it created?

[@CloudAdvocate]

Yes

[@rincymathew7716]

Hi GK, thanks for this video, cleared my doubt. Just one question, while doing the lab today, I observed that, I can only see one by default service account i.e. default compute engine service account and could not find default App engine service account. Is there anything changed?

[@CloudAdvocate]

Hi Rincy, there must be one. Did you check in IAM section?

[@rincymathew7716]

@@CloudAdvocate Yes, I followed the lab/steps provided in this video today and can only see one service account (default compute engine service).

[@rincymathew7716]

@@CloudAdvocate Also could you please advise which practice set should I go through to check my understanding/knowledge before appearing the exam.

[@rincymathew7716]

Hi GK, hope you are doing good. If you get sometime to check my queries and reply please. Appreciate your help..

[@amuc3914]

Nice videos.Is there any sequence we need to follow

[@CloudAdvocate]

Thank you!, yes you could find the order via study guide in the description.

[@manishsharma9490]

Hi Sir, if you give a service account permission - storage object creator access then viewer is given along with that? do we separately need to add viewer role there?

[@CloudAdvocate]

Yes you do

[@MrMuthukumar2002]

Thanks for the great video can you provide the link for Google's document Thanks Muthu

[@CloudAdvocate]

It's there in the description

[@lazyac_]

god bless you

[@Shiki229]

Thanks!

[@CloudAdvocate]

You bet!

[@ajaymahar5538]

Good info thanks 👍, I have a question when we give permission to read and write to cloud storage it can read and write to all the bucket available in cloud storage... Suppose I want to give read and write permission to only specific bucket not all the buckets how we can do that? Is there a way to achieve this

[@CloudAdvocate]

Thanks Ajay, did you check bucket ACL's.

[@ajaymahar5538]

@@CloudAdvocate my questions was for service account if I need to allow vm1 to have read and write access to specific bucket.. how we can do that?

[@CloudAdvocate]

@@ajaymahar5538 yes using ACL's can you try adding vm svc account to bucket as writer and give reader to svc account.

[@ajaymahar5538]

@@CloudAdvocate I might be missing something... If possible can you create requested video about this topic?

[@CloudAdvocate]

@@ajaymahar5538 sure Ajay :)

[@mukhtarali9476]

i have a question , how to give the user specific permission to cloud source repository that user can access only one repository.

[@CloudAdvocate]

I personally haven't tried that but as per doc you can give permissions within a project cloud.google.com/source-repositories/docs not sure if you can achieve that using conditions.

[@user-qi4cu9le4l]

hi how to add this extra permission/role i.e storage.buckets.create to this existing service account we created. i opened the created service account to add that role but i could not see the option. please clarify me.

[@user-qi4cu9le4l]

actually i dont have the option 'Edit' button of service account

[@user-qi4cu9le4l]

i tried with gcloud with this command but no luck - gcloud projects add-iam-policy-binding ${sinuous-crow-398819} \ --member=serviceAccount:${111439973901519643627} \ --role=roles/storage.buckets.create

[@user-qi4cu9le4l]

hi thanks, ignore all above .. on a temporary solution i could able to add a new role( basic role - Owner) to the service account then i colud able to create a new bucket....

[@RaoVenu]

Hello Do you know how SAAS companies which integrate with GSuite services like GDrive/GCalendar work? Do they use service accounts or OAUTH2? For example, if I was create an B2B SAAS app to manage gdrive docs of employees in a company, is it possible to do so using service accounts for a more seamless workflow? Thanks Rao

[@CloudAdvocate]

Great question Venu, I will dig more on this in my company and get back to you. Basically you are asking how gsuite integration is done with the employees correct?

[@RaoVenu]

@@CloudAdvocate Yes. If Acme Inc was using my GSuite and was my customer, how would integration with GSuite work? a) Do I use Oauth2 and store the access / refresh token of individual employees of Acme Inc in my database b) or Do I have the admin of Acme Inc send me the credentials.json (which I store in my database) Thanks for taking the time to respond and look into this for me. -Rao

[@mohitpatiyala]

They would be using Service Account with user managed key , Service accounts will generate OAUTH (JWT) token when using external/user-managed keys, check the example kzbin.info/www/bejne/gGPKXod5bsSlfas

[@SasidharKhambhampati]

HI GK, how can i use a google cloud speech to text API from my local machine application

[@CloudAdvocate]

Using service account you should be able to do that easily.

[@chitranair8143]

What is the best way to remember the command lines

[@CloudAdvocate]

Through practice and understand the structure of command.

[@satishtesting19]

is it possible to setup postman to query bigquery tables ?

[@CloudAdvocate]

Yes using query method of api.

[@satishtesting19]

@@CloudAdvocate can you share me any link or video that i can go through. I have service account details. But i don't have the json file when the service account was created. All i was provide with service account details

[@satishtesting19]

@@CloudAdvocate can you let me know or share any link that narrates how to setup postman. all i have in handy is service account.

[@pinkiyadav7563]

Hello I want to use Google translation API in Project How can use that Please help me in that.

[@CloudAdvocate]

What's the issue you are facing?

[@pinkiyadav7563]

@@CloudAdvocate actually I want to create a page with two textboxes . In first textbox we will enter some text to translate and the result will be shown in second textbox. I want to use google translate API for that. i am not able to understand what what steps i have to follow to achieve that. Thanx for response.

[@prasanjitswain17]

What will be happen If I delete the google manage service default account

[@CloudAdvocate]

You can create a new one and attach it to GCE.

[@prasanjitswain17]

@@CloudAdvocate thanks for the comment. what to do in case if google managed service account has over permission ed. And I really not sure what to do in this case.

[@CloudAdvocate]

Prasanjit Swain Can you please elaborate the scenario.

[@vpratapify]

Is it possible to share OneNote notebook ?

[@CloudAdvocate]

Sorry forgot, I will.

[@CloudAdvocate]

I have put the link in the description, Thanks!👍

[@pradeepkumarkogala5770]

Gcp video clarity very less

[@sudoers-workspace-here]

Better to delete this video. even your YT also.

[@CloudAdvocate]

Why is this outdated?