我是Google Cloud的新手。
我了解到，由于其编辑器角色，删除默认服务帐户是最好的实践。但是，一旦删除它，我就无法启动市场解决方案。使用编辑器角色创建一个新的服务帐户也不起作用。
我使用以下步骤：
- 禁用默认服务帐户
- 仅在需要使用市场解决方案创建VM时
- 更改VM之后的服务帐户才能启用该帐户
。推荐的最佳实践是什么？
I'm new to Google Cloud.
I learned that it is best practice to delete default service account due to its editor role. However, once I deleted it, I am unable to launch a marketplace solution. Creating a new service account with editor role doesn't work either.
I am using the following steps:
- Disable the default service account
- Enable it only when it is required to create the VM using a marketplace solution
- Change the service account after the VM is created
What is the recommended best practice?
发布评论
评论（1）
默认服务帐户是使用IAM基本编辑器角色创建的，但是您可以修改服务帐户的角色以控制服务帐户对Google API的访问。
您可以禁用或删除此服务帐户因此，可能导致任何取决于服务帐户的凭据失败的应用程序。因此，正如 @john Hanley 所提到的，请勿删除Google为您创建的服务帐户。而是创建一个新的服务帐户，并在需要时使用它。
您可以使用创建和启用实例的服务。
如果您删除了默认服务帐户，则可以尝试在30天内恢复帐户。 30天后，IAM永久删除了服务帐户。 Google Cloud永久删除后，即使您提出了支持请求，也无法恢复该帐户。
请参阅撤消服务帐户 以获取更多信息。
The default service account is created with the IAM basic Editor role, but you can modify your service account's roles to control the service account's access to Google APIs.
You can disable or delete this service account from your project, but doing so might cause any applications that depend on the service account's credentials to fail. So as mentioned by @John Hanley do not delete service accounts that Google created for you. Instead, create a new service account and use that when required.
You can create and manage your own service accounts using IAM. After you create an account, you grant the account IAM roles and set up instances to run as the service account. Apps running on instances with the service account attached can use the account's credentials to make requests to other Google APIs. Refer creating and enabling service account for instances.
If you have deleted the default service account, you can try to recover the account within 30 days. After 30 days, IAM permanently removes the service account. Google Cloud cannot recover the service account after it is permanently removed, even if you file a support request.
Refer Undeleting a Service account for more information.