Does service account login expires in a vm on GCP

[mehulparmariitr]

I used this command to loginto service account with a key file and deleted the key file. Should I bother about relogin in future or service accounts login does not expire in a vm on GCP? 

gcloud auth activate-service-account [ACCOUNT] --key-file=KEY_FILE [--password-file=PASSWORD_FILE     | --prompt-for-password] [GCLOUD_WIDE_FLAG …]

[kolban]

That's a good question.  My gut says that the key file is used to prove you are who you claim to be and is used in place of a userid/password (which don't exist for a service account).  However, after you login with gcloud, what are returned are an OAuth access token and an OAuth refresh token which (I believe) are then saved to disk.  If this is correct, then you will remain "logged in" from a gcloud perspective irrespective of the key file.  The key file was only used to grant you the tokens but deletion of the key file doesn't delete the tokens.  To remove the tokens (logout) I think you want to run:

gcloud auth revoke <your account>

[mehulparmariitr]

And what is the expiry cycle of these tokens?

[kolban]

Sadly I'm not an expert on this stuff but will try and do some more study and get back with deeper answers.  My immediate belief is that two tokens are returned ... the Access Token and the Refresh Token.   A current/valid access token is needed to make a request.  It will have a "timeout" associated with it.  When the current access token expires, the refresh token will be used to request a new access token and that will then be used and the story refreshes.  The gcloud command (and client libraries) know how to access these saved tokens and handle the refresh on your behalf so you need do nothing to refresh on the client/caller side.  I'm assuming that the refresh token doesn't expire but can be invalidated/deleted.

Later: More details at:

• Token types
• gcloud auth application-default print-access-token
• It appears credentials are locally stored in ~/.config/gcloud