Default Service Account Editor Role

Question

I'm new to Google Cloud.

I learned that it is best practice to delete default service account due to its editor role. However, once I deleted it, I am unable to launch a marketplace solution. Creating a new service account with editor role doesn't work either.

I am using the following steps:

• Disable the default service account
• Enable it only when it is required to create the VM using a marketplace solution
• Change the service account after the VM is created

What is the recommended best practice?

Answer 1

The default service account is created with the IAM basic Editor role, but you can modify your service account's roles to control the service account's access to Google APIs.

You can disable or delete this service account from your project, but doing so might cause any applications that depend on the service account's credentials to fail. So as mentioned by @John Hanley do not delete service accounts that Google created for you. Instead, create a new service account and use that when required.

You can create and manage your own service accounts using IAM. After you create an account, you grant the account IAM roles and set up instances to run as the service account. Apps running on instances with the service account attached can use the account's credentials to make requests to other Google APIs. Refer creating and enabling service account for instances.

If you have deleted the default service account, you can try to recover the account within 30 days. After 30 days, IAM permanently removes the service account. Google Cloud cannot recover the service account after it is permanently removed, even if you file a support request.

Refer Undeleting a Service account for more information.