Where can I see the PubSub service account?

Question

The PubSub service account is service-<PROJECT_NUMBER>@gcp-sa-pubsub.iam.gserviceaccount.com

The command described here to create an IAM policy binding succeeds, which shows that the service account exists.

But it does not appear in

• the list of service accounts in the console https://console.cloud.google.com/iam-admin/serviceaccounts?project=<PROJECT> (screenshot below)
• nor in the IAM permissions list https://console.cloud.google.com/iam-admin/iam?project=<PROJECT> , even when I check "Include Google-provided role grants"
• nor in the output of gcloud iam service-accounts list --project <PROJECT>.

Where can I see this service account listed?

Answer 1

The service-<PROJECT_NUMBER>@gcp-sa-pubsub.iam.gserviceaccount.com is a Google managed service account, therefore, you can see it in the list YOUR PROJECT service accounts.

In addition, you have granted this service account on a TOPIC resource and not on a PROJECT resource. Therefore, when you go on the iam-admin page, you can see the service account at the PROJECT ressource.

Anyway, you could be able to view it in the iam-admin page by checking Include Google-provided role grants

Because you have granted the service account at TOPIC resource level, you can see it in the TOPIC page

Go to the topic page, check a topic and go to the right-hand panel, in the permission section and look at the role that you grant on the service account. You will find it