CODEWITHSUNDEEP
google-cloud-platformgoogle-compute-enginegoogle-cloud-iam
Rahul Sharma
Rahul Sharma

Reputation: 1

How can I disable a GCP Service Account to create VM instances?

I need to disable a service account in Cloud IAM to create Compute Engine instances. Currently the service account has the Editor role on the project.

I tried adding a condition to disable compute/instance using condition builder but it doesn't allow this, saying primitive roles cannot be edited.

Upvotes: 0

Views: 492

Answers (1)

Vikram Shinde
Vikram Shinde

Reputation: 1028

Condition Builder is in Beta.

You can remove the editor role and assign the required (custom) role to Service Account.

  • Open the IAM & Admin page in the Cloud Console. Click Select a project, choose a project, and click Open.

  • Identify the service account to which you want to add a role.

  • If the service account isn't already on the members list, it doesn't have any roles assigned to it. Click Add and enter the email address of the service account. If the service account is already on the
    members list, it has existing roles. To edit the service account's
    roles, click the Edit edit button. Select one or more roles to apply to the service account.

  • Click Save to apply the roles to the service account.

Another option is: Restrict access who can use the Service account.

Upvotes: 1

Related Questions