Creating a Service Account via Google Cloud Console (UI)

I wanted to use Vertex AI, and learned that I need some sort of Service Account that does not need to set user permission whenever we need to use it.

In Google Cloud Platform (GCP), a Service Account is a special type of Google account intended for non-human users, like applications or virtual machines, to authenticate and access GCP resources securely. Unlike Google Workspace users which represent individual people with email addresses and passwords, Service Accounts are identified by email-like addresses managed by GCP, and are authenticated using cryptographic keys instead of passwords. To use Vertex AI API, you'll need a Service Account with the appropriate permissions (e.g., Vertex AI User, Vertex AI Administrator) granted through IAM (Identity and Access Management) to authorize your application to make API calls and access the necessary data and services.
 

What you will have after creating Service Accounts

After creating service accounts, you will have API identities that your applications can use to authenticate and authorize themselves to access Google Cloud resources. Specifically, you'll typically have:

• Service Account Email Address: This is the unique identifier for the service account. It looks like an email address (e.g., my-service-account@project-id.iam.gserviceaccount.com). It's used to grant permissions.
• Service Account Keys (Optional but Common): These are used by your application to prove its identity.
  • JSON Key: This is the most common type, especially when the application is running outside of Google Cloud. It contains a private key used to generate credentials. Important: Store this securely! Don't commit it to a code repository or leave it in a public directory.
  • Other Key Types (Less Common): Other key types exist for specific scenarios, but JSON keys are generally the most versatile.
• IAM Permissions: These determine what the service account is allowed to do. You grant roles to the service account at the project, folder, or resource level using IAM (Identity and Access Management).

How do you create a Service Account via Google Cloud Console (UI)?

1. Go to the IAM & Admin > Service Accounts

• Open: https://console.cloud.google.com/iam-admin/serviceaccounts 
• Make sure you're in the correct project.

2. Click "Create Service Account"

Fill in:

• Service account name (e.g., vertex-ai-client)
• (Optional) Description

Click "Create and Continue".

3. Grant This Service Account Access to the Project

Choose a role that gives access to Vertex AI. Common choices:

• Vertex AI User (roles/aiplatform.user)
• Optionally, add:
  • roles/storage.objectViewer if reading from Cloud Storage.
  • roles/aiplatform.admin for full access (use with caution).

Click Continue → Done.

4. Generate and Download a Key File

1. Find your service account in the list.
2. Click the three dots menu (⋮) → Manage keys.
3. Click Add Key → Create new key.
4. Choose JSON.
5. Click Create → the key file will download (.json).

⚠️ Keep this file secure. It contains credentials that allow access to your Google Cloud services.

In summary, creating a service account gives you an identity and the means (keys, if you generate them) to *use* that identity to access Google Cloud resources in a controlled and secure way. It allows your application to act *as* the service account, following the IAM policies you've defined for it.