K
Q

Deleted Compute Engine default service account

4/28/2016

I cannot create a virtual machines in GCE.. While creating it is showing the error message, i have attached my screen-shot of error message.. i will briefly explain what i have done..

--> I have deleted my compute engine default service account from my service account list.. later i created new service account..

--> While creating virtual machines i selected newly created service account, vm creating was failed but the error shows the deleted service account id is not found under service account..

--> While creating vm's it is referring my deleted service account id..

Now what i need to do? Is there is any solution to reactivate my Compute Engine default service account.. Completely iam struck now i cannot create new vms and kubernetes. enter image description here

-- Anumantha Raja
google-compute-engine
google-kubernetes-engine

Similar Questions

Upgrade image in a Deployment's pods
Google Container Engine - How do I detect that requests to my service are health checks?
Google Container Engine - How do I specify the level of log messages?
Google Container Engine - How do I configure the amount of logs to keep?

4 Answers

8/24/2019
  1. First you need to find the removed SERVICE_ACCOUNT_ID. Using Logging advanced queries is:
resource.type = "service_account"
protoPayload.authorizationInfo.permission = "iam.serviceAccounts.delete"

Example here:

\==> unique_id value is SERVICE_ACCOUNT_ID

  1. Use the API provided by @sherief-el-feky :
curl -X POST -H "Authorization: Bearer $ (gcloud auth print-access-token)" -H "Content-length: 0" https://iam.googleapis.com/v1/projects/-/serviceAccounts/SERVICE_ACCOUNT_ID : undelete "
-- NguyenNhatKhang
Source: StackOverflow
11/21/2017

To restore your google compute default service account, run the following gcloud command within your project:

gcloud services enable compute

In previous versions the command was known to be:

gcloud service-management enable compute.googleapis.com

As stated in this issue: https://issuetracker.google.com/issues/69612457

-- Overbryd
Source: StackOverflow
8/5/2019

You can now "undelete" service accounts by doing a curl request as below:

curl -X POST -H "Authorization: Bearer $(gcloud auth print-access-token)" -H "Content-length: 0" "https://iam.googleapis.com/v1/projects/-/serviceAccounts/SERVICE_ACCOUNT_ID:undelete"

SERVICE_ACCOUNT_ID is the id of the account you want to recover

You can get a list of service accounts by running:

gcloud logging read "resource.type=service_account" --freshness=10y

Reference: https://cloud.google.com/iam/docs/creating-managing-service-accounts#undeleting_a_service_account

-- Sherief El-Feky
Source: StackOverflow
4/28/2016

There are two default service accounts and I am not sure which one you are referring to:

  1. Google API service account, in your case it is called: 933144605699@cloudservices.gserviceaccount.com. It is a special service account. It is always created but never listed in gcloud or the web console. It is intended to be used by some of the internal Google processes on user's behalf. GKE may be one of the services that uses this account (I am not sure). It is impossible to delete this account, the only thing you could do is to remove it from any roles on the project. By default it is an Editor. You can add it back any time.
  2. Default service account: 933144605699-compute@developer.gserviceaccount.com. This is a normal service account, which you may delete.

In the error message you pasted there is a different service account name, is it the new one you created? If this is the case, you might only need to go to IAM settings on the web console and add your user to service account actor. Take a look at this manual page: https://cloud.google.com/compute/docs/access/iam#the_serviceaccountactor_role

-- Grzenio
Source: StackOverflow