Search code examples
google-cloud-platformgoogle-cloud-sqlgoogle-cloud-iam

What is the "speckle-umbrella" service account associated with Google Cloud SQL instances?


On the instance details page of my Google Cloud SQL instance, I see that there's a "Service account" card on the dashboard with a value. The domain of which includes speckle-umbrella. This account doesn't show up in the IAM settings or any service account lists. Regarding its purpose, the most I've been able to find is this question but it seems to only deal with granting the account privileges. A couple of questions:

  • What is this account for?
  • Why is this account not enumerated with the rest of the service accounts?

Solution

  • Google Cloud SQL is a managed service and the instances you create and use actually run in a Google-owned project. The service account you mentioned belongs to that project and is used to perform operations in that project.

    The relationship between both projects is clearer with some specific use-cases. For example, in the other SO question you linked about exporting data from CloudSQL to Google Cloud Storage, you need to grant access to your bucket to the service account in question since this SA will be used to authenticate the request to GCS.

    Another example is when you create a CloudSQL instance with private IP. The connection through internal IP is made available by actually peering your network in your project with the network in the speckle-umbrella project where your CloudSQL instance resides. You're then able to see that peering in your Developer Console showing the "speckle-umbrella" project as peered project ID.