CODEWITHSUNDEEP
google-compute-enginegoogle-kubernetes-engine
Anumantha Raja
Anumantha Raja

Reputation: 281

Deleted Compute Engine default service account

I cannot create a virtual machines in GCE.. While creating it is showing the error message, i have attached my screen-shot of error message.. i will briefly explain what i have done..

--> I have deleted my compute engine default service account from my service account list.. later i created new service account..

--> While creating virtual machines i selected newly created service account, vm creating was failed but the error shows the deleted service account id is not found under service account..

--> While creating vm's it is referring my deleted service account id..

Now what i need to do? Is there is any solution to reactivate my Compute Engine default service account.. Completely iam struck now i cannot create new vms and kubernetes. enter image description here

Upvotes: 8

Views: 8313

Answers (5)

Mr. Unnormalized Posterior
Mr. Unnormalized Posterior

Reputation: 819

As of Feb 2022, use

gcloud beta iam service-accounts undelete <ACCOUNT ID>

ACCOUNT ID is the 21 digit unique id (uid) which last part of the deleted service account.

For example,

deleted:serviceAccount:[email protected]?uid=123451234512345123451

uid is the last part of the above service account.

Upvotes: 0

NguyenNhatKhang
NguyenNhatKhang

Reputation: 11

  1. First you need to find the removed SERVICE_ACCOUNT_ID. Using Logging advanced queries is:
resource.type = "service_account"
protoPayload.authorizationInfo.permission = "iam.serviceAccounts.delete"

Example here:

==> unique_id value is SERVICE_ACCOUNT_ID

  1. Use the API provided by @sherief-el-feky :
curl -X POST -H "Authorization: Bearer $ (gcloud auth print-access-token)" -H "Content-length: 0" https://iam.googleapis.com/v1/projects/-/serviceAccounts/SERVICE_ACCOUNT_ID : undelete "

Upvotes: 1

Sherief El-Feky
Sherief El-Feky

Reputation: 81

You can now "undelete" service accounts by doing a curl request as below:

curl -X POST -H "Authorization: Bearer $(gcloud auth print-access-token)" -H "Content-length: 0" "https://iam.googleapis.com/v1/projects/-/serviceAccounts/SERVICE_ACCOUNT_ID:undelete"

SERVICE_ACCOUNT_ID is the id of the account you want to recover

You can get a list of service accounts by running:

gcloud logging read "resource.type=service_account" --freshness=10y

Reference: https://cloud.google.com/iam/docs/creating-managing-service-accounts#undeleting_a_service_account

Upvotes: 8

Overbryd
Overbryd

Reputation: 5006

To restore your google compute default service account, run the following gcloud command within your project:

gcloud services enable compute

In previous versions the command was known to be:

gcloud service-management enable compute.googleapis.com

As stated in this issue: https://issuetracker.google.com/issues/69612457

Upvotes: 6

Grzenio
Grzenio

Reputation: 36649

There are two default service accounts and I am not sure which one you are referring to:

  1. Google API service account, in your case it is called: [email protected]. It is a special service account. It is always created but never listed in gcloud or the web console. It is intended to be used by some of the internal Google processes on user's behalf. GKE may be one of the services that uses this account (I am not sure). It is impossible to delete this account, the only thing you could do is to remove it from any roles on the project. By default it is an Editor. You can add it back any time.
  2. Default service account: [email protected]. This is a normal service account, which you may delete.

In the error message you pasted there is a different service account name, is it the new one you created? If this is the case, you might only need to go to IAM settings on the web console and add your user to service account actor. Take a look at this manual page: https://cloud.google.com/compute/docs/access/iam#the_serviceaccountactor_role

Upvotes: 1

Related Questions