Every night at 2:00 AM, a company’s sales report runs on Google Cloud. Nobody is awake, so nobody is typing a password. Yet the job still reads BigQuery and saves a file to a bucket. So who is logged in?
The answer is a Google Cloud service account. It is an identity made for apps and automated jobs instead of people. In this guide, you will learn what it is, why it matters, and how to create one using the console, CMD and PowerShell.
Last reviewed: November 2026
In this guide:
- What is a Google Cloud service account?
- Why create one?
- What is the use of it?
- Real-time industry example
- Create it in the console (UI)
- Create it with CMD
- Create it with PowerShell
- FAQs
What Is a Google Cloud Service Account?
A Google Cloud service account is a special account used by an application or workload, not by a person. It has its own email address, and you control what it can do with IAM roles.
Think of an office ID card given to a delivery robot. The robot is not an employee, but the card tells the security system who it is and which doors it may open. A Google Cloud service account is that card for your software.
The email looks like this:
reporting-job@my-shop-project.iam.gserviceaccount.comUser Account vs Service Account
| Point | User account | Service account |
|---|---|---|
| Used by | A person | An app or job |
| Example | analyst@example.com | reporting-job@...iam.gserviceaccount.com |
| Runs without a person | No | Yes |
| When someone leaves | The account is removed | The app keeps working |
That last row is a big deal. If a nightly job runs under a developer’s login and that developer leaves the company, the job can break. A service account does not resign.
Types of Google Cloud Service Accounts
| Type | Created by | What to know |
|---|---|---|
| User-managed | You | The one you should normally use for your apps |
| Default | Google Cloud, when you use some services | May have the broad Editor role, so avoid sharing it |
| Service agent | Google Cloud | Lets a Google service work for you, so leave it alone |
Why Create a Google Cloud Service Account?
- No personal logins in apps: Your code does not depend on one employee.
- Smaller damage if something goes wrong: A hacked app gets only the access its account has.
- Clear audit trail: Logs can show that
reporting-jobdid the work, not a shared account. - No passwords in code: When attached to a Google Cloud resource, the account gets short-lived credentials automatically.
- Exact permissions: One job can read one bucket and do nothing else.
What Is the Use of a Service Account?
You will use a Google Cloud service account in these common situations:
- Apps: A Cloud Run service reads files from Cloud Storage.
- Scheduled jobs: A nightly report queries BigQuery.
- Data pipelines: Dataform runs SQL, and Dataflow workers process data.
- Automation: Workflows calls several services in order.
- Testing access: A developer can temporarily act as an account to check its permissions.
Remember that a Google Cloud service account is only an identity. It can do nothing until you grant it roles. If roles are new to you, read our Google Cloud IAM guide first.
Real-Time Industry Example of a Google Cloud Service Account
Let us use a retail company with an online shop. Every night, a Cloud Run job does this:
- Runs a BigQuery query for yesterday’s sales.
- Saves the report to a Cloud Storage bucket.
The wrong way: A developer downloads a key with the Editor role and puts it in the code. Now anyone who finds the file can change almost anything in the project.
The right way: Create a separate service account named reporting-job, and give it only what the job needs:
| Task | Role | Given on |
|---|---|---|
| Run BigQuery queries | BigQuery Job User | Project |
| Read the sales data | BigQuery Data Viewer | The shop dataset |
| Save the report | Storage Object Creator | The reports bucket |
If this job is ever compromised, the attacker cannot delete your tables, read your other buckets or change your Cloud Run services. That is the whole point.
Other industries use the same idea:
| Industry | App | Service account access |
|---|---|---|
| Banking | Statement generator | Reads transactions, writes PDFs to one bucket |
| Healthcare | Lab report uploader | Adds files to one secure bucket |
| Logistics | Delivery tracking app | Publishes location events to Pub/Sub |
| Media | Video processing job | Reads uploads, writes finished videos |
Now let us build the reporting-job Google Cloud service account. Choose any one method below. You need the Service Account Creator role to create it, and Project IAM Admin to grant project roles. If you created the project yourself, your Owner role covers both.
The account name must be 6 to 30 characters, using lowercase letters, numbers and dashes. You cannot change it later, so choose a name that explains the job.
Method 1: Create a Google Cloud Service Account in the Console (UI)
This is the easiest way if you are new.
- Open the Create service account page and select your project.
- Enter
reporting-jobas the service account name. The console fills in the ID for you. - Enter a description, such as
Creates the nightly sales report. - Click Create and continue.
- Select the BigQuery Job User role, then click Continue.
- Leave the user access section empty for now and click Done.
Your new account now appears in the list with its email address. Next, open your bucket in Cloud Storage, go to the Permissions tab, click Grant access, paste that email, select Storage Object Creator and click Save.
Before You Use CMD or PowerShell
Install the Google Cloud CLI and sign in. Run this in either terminal:
gcloud auth loginThe commands are the same in both terminals. Only these details change:
| Item | CMD | PowerShell |
|---|---|---|
| Create a variable | set NAME=value | $NAME = "value" |
| Use a variable | %NAME% | $NAME |
| Continue on the next line | ^ | ` (backtick) |
One small trap: nothing can come after ^ or the backtick on a line, not even a space. Linux, Mac and Cloud Shell use \ instead.
Method 2: Create a Google Cloud Service Account with CMD
Open Command Prompt and replace my-shop-project and the bucket name with your own.
Step 1: Set your values.
set PROJECT_ID=my-shop-project
set SA_EMAIL=reporting-job@%PROJECT_ID%.iam.gserviceaccount.com
gcloud config set project %PROJECT_ID%Step 2: Create the account.
gcloud iam service-accounts create reporting-job ^
--display-name="Reporting Job" ^
--description="Creates the nightly sales report"Step 3: Confirm that it exists. A new account can take 60 seconds or more to be ready, so wait a minute if you get an error.
gcloud iam service-accounts describe %SA_EMAIL%Step 4: Let it run BigQuery queries.
gcloud projects add-iam-policy-binding %PROJECT_ID% ^
--member="serviceAccount:%SA_EMAIL%" ^
--role="roles/bigquery.jobUser"Step 5: Let it save files to one bucket.
gcloud storage buckets add-iam-policy-binding gs://shop-reports-2026 ^
--member="serviceAccount:%SA_EMAIL%" ^
--role="roles/storage.objectCreator"Method 3: Create a Google Cloud Service Account with PowerShell
These are the same steps for Windows PowerShell.
Step 1: Set your values.
$PROJECT_ID = "my-shop-project"
$SA_EMAIL = "reporting-job@$PROJECT_ID.iam.gserviceaccount.com"
gcloud config set project $PROJECT_IDStep 2: Create the account.
gcloud iam service-accounts create reporting-job `
--display-name="Reporting Job" `
--description="Creates the nightly sales report"Step 3: Confirm that it exists.
gcloud iam service-accounts describe $SA_EMAILStep 4: Let it run BigQuery queries.
gcloud projects add-iam-policy-binding $PROJECT_ID `
--member="serviceAccount:$SA_EMAIL" `
--role="roles/bigquery.jobUser"Step 5: Let it save files to one bucket.
gcloud storage buckets add-iam-policy-binding gs://shop-reports-2026 `
--member="serviceAccount:$SA_EMAIL" `
--role="roles/storage.objectCreator"Give the Account Access to One BigQuery Dataset
Whichever method you used, finish the setup with this SQL in the BigQuery editor. Replace the project ID. This lets the account read only the shop dataset.
GRANT `roles/bigquery.dataViewer`
ON SCHEMA `my-shop-project`.shop
TO "serviceAccount:reporting-job@my-shop-project.iam.gserviceaccount.com";How to Use a Google Cloud Service Account
Creating a Google Cloud service account is only half the job. Now your app must use it. The usual way is to attach it to a resource, so code on that resource runs as that account.
Run this from your job’s code folder. To attach an account, you need the Service Account User role on it.
CMD:
gcloud run jobs deploy daily-sales-report ^
--source . ^
--region=asia-south1 ^
--service-account=%SA_EMAIL%PowerShell:
gcloud run jobs deploy daily-sales-report `
--source . `
--region=asia-south1 `
--service-account=$SA_EMAILYour code needs no password or key file. Google client libraries pick up the attached identity by themselves.
How to Test the Permissions
You can test the account without downloading a key by using impersonation, which means temporarily acting as that account. These are the PowerShell commands. In CMD, use %SA_EMAIL% and ^.
gcloud services enable iamcredentials.googleapis.com
gcloud iam service-accounts add-iam-policy-binding $SA_EMAIL `
--member="user:you@example.com" `
--role="roles/iam.serviceAccountTokenCreator"
"test report" | Out-File test.txt
gcloud storage cp test.txt gs://shop-reports-2026/test.txt `
--impersonate-service-account=$SA_EMAIL
gcloud storage ls gs://shop-reports-2026 `
--impersonate-service-account=$SA_EMAILThe upload should work, and the list command should fail with a permission error. That failure is good news. The account can add files but cannot browse the bucket, which is exactly what we planned.
How to Disable or Delete a Google Cloud Service Account
Disable an account first if you are not sure whether anything still uses it. You can turn it back on if something breaks. These commands work the same in CMD with %SA_EMAIL%.
gcloud iam service-accounts list
gcloud iam service-accounts disable $SA_EMAIL
gcloud iam service-accounts enable $SA_EMAIL
gcloud iam service-accounts delete $SA_EMAILA deleted account can be restored only within 30 days. After that, it is gone for good.
Should You Use a Google Cloud Service Account Key?
Many old tutorials begin by downloading a JSON key. Try to avoid that. Anyone who gets the file can use it, and Google recommends avoiding keys whenever possible.
| Where the code runs | Use this instead of a key |
|---|---|
| On Google Cloud | Attach the service account |
| Outside Google Cloud, such as GitHub Actions | Workload Identity Federation |
| On your laptop during development | Your user login or impersonation |
If you truly must use a key, never commit it to Git or leave it in a shared or Downloads folder.
Google Cloud Service Account Mistakes to Avoid
- Giving it Owner or Editor: Start with the smallest role that works.
- Sharing one account across apps: Create one account for each app or job.
- Using the default account in production: It may have broader access than your app needs.
- Letting too many people act as the account: They gain all of its access.
- Using vague names:
reporting-jobtells you far more thantest-sa-2. - Deleting an account too quickly: Move running apps away and disable it first.
Conclusion
A Google Cloud service account gives your software its own identity, so your apps do not depend on a person’s login. Create one account for each job, give it the smallest access it needs, and attach it to the resource instead of downloading a key.
Try it now in a test project with whichever method you like. Then run the impersonation test, because seeing that permission error makes the whole idea click. For more details, read the official Google Cloud service account documentation and Google’s security best practices.
FAQs
Q1: What is a Google Cloud service account in simple words?
It is an identity for an app or automated job. It works like an employee ID card, but for software.
Q2: Can a person use a Google Cloud service account?
A permitted person can temporarily act as one using impersonation. Normally, apps and workloads use it.
Q3: Is a Google Cloud service account the same as IAM?
No. IAM is the access control system. A service account is one identity that IAM can give roles to.
Q4: Do I need a JSON key for a Google Cloud service account?
Usually not. On Google Cloud, attach the account to your resource.
Q5: Can I rename a service account?
You cannot change its ID after creation. To use a different ID, create a new account.
Q6: Why do I get a permission error right after creating one?
A new account or role can take a little time to apply. Wait a few minutes, then check the role and resource.