Grant Service Account Access for Vendors via Google Cloud Marketplace

[urip_g]

I found the following Google Cloud Marketplace docs, which seem to suggest vendors have a way to onboard customers for a service-account API access/integration, via a structured process:

https://cloud.google.com/marketplace/docs/grant-service-account-access#granting_access_to_a_service_...

However, I can't seem to find any documentation about how to leverage this capability. Can anyone share more info about this capability? Thanks in advance.

[rayjohnn]

Good day and welcome to the community!

Granting a vendor access to your Google Cloud project via a Service Account involves several steps which includes creating a Service Account, granting appropriate permissions, and sharing the Service Account credentials securely with the vendor.

Here are some recommendations on how to do them:

1.You need to check if the service account is created. If not here is the steps to do it:

• Go to IAM & Admin > Service Accounts in the Cloud Console. 
• Click "Create Service Account", enter a name and description for the Service Account, and click "Create".

2. Make sure to grant permissions to the Service Account created. You will be asked to grant this account IAM roles. These roles determine what permissions the Service Account has. Choose the roles that align with the necessary permissions for the vendor. 
3. Generate a key for the Service Account: Once the Service Account is set up, you need to create a key which will be used by the vendor to authenticate as the Service Account. 

• Click on the Service Account, then click "Add Key", and choose "JSON". This will generate a JSON key file.

Hope this information helps. I included the documentation for added reference.[1][2][3]

[1] https://cloud.google.com/iam/docs/service-accounts-create

[2] https://cloud.google.com/iam/docs/granting-roles-to-service-accounts

[3] https://cloud.google.com/iam/docs/keys-create-delete

[urip_g]

Hi @rayjohnn, thank you for your answer!

I'm aware of the manual process you mentioned, and also of the process via a Terraform/Cloud Deployment script. What I'm curious about is that the mentioned segment from the docs seems to suggest there's a way for a vendor to provide a link that would allow customers to review the new service account, roles, and select projects, in some kind of interface. "If the app is included in multiple projects that you have access to, you can select all those projects", etc.

Any idea what this is about? It's also mentioned this is "Pre-GA" at the top of the page.