As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [service-accounts]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
45 views

SSH Keys not propagating correctly from instance metadata to authorized_keys: missing keys, user discrepancy, and duplicate key

I want to add eight public keys via instance metadata to avoid adding them manually (i.e.: ssh to VMs, pasting the keys to .ssh/authorized_keys, etc.). I added the keys in Terraform (four distinct ...
mångata's user avatar
  • 109
0 votes
0 answers
28 views

How to use service account to deploy objects(deployments, configmaps etc) in Kubernetes

I have a deploy-pipeline in Azure devops. I am using this to deploy some objects to our k8s cluster (microk8s). I connect to the cluster with the help of a service connection that uses a kube-config. ...
Viktor Eriksson's user avatar
0 votes
0 answers
130 views

StorageQuotaExceeded: The user's Drive storage quota has been exceeded.) for service account - how do I increase it?

I have a google drive API integration setup using a service account. The service account name ends in: iam.gserviceaccount.com. Now it is correct that this account has quite some files created in our ...
Niels Kristian's user avatar
0 votes
0 answers
17 views

Secure BigQuery Service account shared key usage in non GCP application

I have request from users to be able to connect to my datasets and table in BigQuery to fetch the data and manipulate it programmatically outside of GCP. The situation now that I created a service ...
AHM's user avatar
  • 1
1 vote
1 answer
492 views

How to grant access for a Google Cloud Service Account to have all the same permissions as a another Service Account?

So I have a Google Cloud Service Account one sa-1@myproject.iam.gserviceaccount.com that has access to roles A and B. There is Service Account two sa-2@myproject.iam.gserviceaccount.com which I need ...
engineer-x's user avatar
0 votes
3 answers
918 views

How to test Windows Service Account can login to SQL Server database?

How to test that a Windows AD service account has been granted access to read from a SQL Server database server via Windows Authentication ? This would need be an isolated test independent of any ...
BaltoStar's user avatar
  • 201
0 votes
1 answer
527 views

Group Managed Service Account not updating password on server

I've just set up a new gMSA on our domain, everything works fine except now that the password has expired, it will not update on the server. I am getting a logon failure for my services. This isn't a ...
Adam's user avatar
  • 1
1 vote
0 answers
532 views

problems with win server 2019 Task Scheduler -> batch file -> python script as service account

I have had a ton of problems trying to set up some automated tasks that execute a batch file which in turn run python scripts. All of these tasks run fine when they are run under my username and I am ...
jasonwardenburg's user avatar
0 votes
1 answer
717 views

What permissions to set in service account for project creation?

When I configure google cloud cli with my credentials, it is able to create a new project and create resources inside it. But, for automation purpose in a pipeline, not able to use with my credentials ...
Kalel's user avatar
  • 136
0 votes
1 answer
996 views

Login to HashiCorp Vault with Kubernetes Auth from Pod with Vault CLI

TL;DR: What is the proper way to login from Vault CLI in a Kubernetes Pod using the Kubernetes Auth Method. I want to create regular snapshots from my HashiCorp Vault raft storage. So I created a ...
Max N.'s user avatar
  • 111
0 votes
1 answer
142 views

Must all services of ADCS run under the same service account on the same server?

While deploying ADCS, on the documentation Microsoft recommends using service accounts for the services making up ADCS. The problem is that it doesn't address if these should be individually managed, ...
Vita's user avatar
  • 111
0 votes
1 answer
1k views

Pod assigned node role instead of service account role on AWS EKS

First some info about the setup: EKS version: 1.21 eksctl version: 0.77.0 AWS Go SDK verion: v1.44.28 Deploying using kubectl I have a k8s cluster on AWS EKS on which I am deploying a custom k8s ...
asr9's user avatar
  • 111
1 vote
1 answer
2k views

Display Existing Policy Bindings for GCP Service Account

I'm setting up a service account to access a CloudSQL DB from GKE. I've created both the GSA and the KSA, and have executed the command to associate the two (gcloud iam service-accounts add-iam-...
Lowell Boone's user avatar
1 vote
0 answers
510 views

MS SQL server 2019 failover cluster - Event ID 18456, Login failed for user 'domain\server1$'

New MS SQL server 2019 installation on Windows Server 2019, failover cluster role enabled; fully patched Windows, SQL 2019 CU 11. Nodes: server1 - 10.10.10.1 server2 - 10.10.10.2 Instances: sql1 sql2 ...
Krackout's user avatar
  • 1,575
4 votes
2 answers
7k views

How do I Generate a Bearer Token for cURL to Get Thru IAP (GCP)?

I need to cURL a web app hosted behind IAP on GCP. Normally, users log in through IAP and use the web app, but I need to run some cURL commands (interactive and non-interactive) that hit the web app ...
user450409's user avatar
0 votes
1 answer
4k views

Accessing BigQuery data from different project in same organization with a Service Account

I'm having some serious trouble getting the official BigQuery client (in Python 3) to a different project in the same organization authorized from a Cloud Run service. The Cloud Run service is in ...
bandwagoner's user avatar
2 votes
0 answers
1k views

Group Managed Service Account access to network share on remote server

We've got a service running using a Group Managed Service Account on a Windows Server 2016 host (HostA). We're extending the functionality of this service so that it runs an R script which needs to ...
Stuart's user avatar
  • 141
3 votes
1 answer
4k views

Sudden permissions denied for service account

I Have a ServiceAccount that has permissions to do all sort of things on my GCP project, and a Jenkins pipeline that runs on nightly basis and shutdown one of my GKE environments. Few days ago i've ...
user14242404's user avatar
0 votes
1 answer
17k views

Access denied (SA doesn't have storage.objects.create access) when trying to upload using a preSigned url to google cloud storage

Having issues trying to allow a client to upload a file via a presigned url. Error received <?xml version='1.0' encoding='UTF-8'?> <Error> <Code>AccessDenied</Code> <Message&...
James's user avatar
  • 1
1 vote
1 answer
457 views

Can I store certificates in the personal store of a virtual service account?

We'd like to make use of virtual accounts (https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd548356(v=ws.10)?redirectedfrom=MSDN#using-virtual-...
Richiban's user avatar
  • 113
2 votes
1 answer
191 views

VM instance down suddenly and fail to restart, showing 'serviceAccount' was not found [closed]

I have a Django server running in VM instance, the server working fine before this, but this morning the server was unable to access. So I tried to SSH into the VM instance, but it took a long time ...
Ye Tien Tang's user avatar
1 vote
1 answer
2k views

Running powershell as service account without logon privilege

I'm trying to run a powershell script as a service account via task scheduler. It has to run as the service account (rather than the local system) to get required permissions to do some of the tasks. ...
user3129594's user avatar
0 votes
0 answers
137 views

IIS Worker doesn't run or crashes immediately

We have an IIS app hosted on Windows 2016 Server which runs fine, when running as Local User or Network Service. One of the customers is setting up the application to run on a Service Account (...
Ranganathan's user avatar
0 votes
1 answer
48 views

Can a service account access all APIs?

For an api-key, one can define which APIs can be accessed with that api-key, but for service accounts, you seemingly can't. I thought maybe I could create a new role that only allows access to the ...
ASA's user avatar
  • 129
1 vote
1 answer
1k views

Google Admin SDK authentication with service account

My team is currently developing an application to list my company's domain users in GCP, using the Admin SDK, for onboarding and offboarding purposes. We're using a service account to do this and we'...
André dias's user avatar
0 votes
1 answer
105 views

Deploying Deep Learning VM - default service account couldn't be detected

I am trying to deploy a deep learning VM (via the marketplace) However I get an error - that there is no valid default service account available. I have tried the following options disabling & ...
Aakash Gupta's user avatar
0 votes
1 answer
753 views

Logon as a service for virtual accounts

I have a Windows Internal Database installation running with its default settings. I have the required "Logon as a service" permissions configured as follows: Administrators ALL SERVICES LOCAL ...
lapingultah's user avatar
0 votes
2 answers
1k views

Unable to export service account key in Terraform #GCP

I have downloaded the GCP service account key to my local system. In Terraform, I have set the GOOGLE_APPLICATION_CREDENTIALS as a path to this file in the startup-script part of my bastion instance. ...
Meghana B Srinath's user avatar
3 votes
2 answers
9k views

ERROR: (gcloud.auth.activate-service-account) Could not read json file /root/gcloud-service-key.json: No JSON object could be decoded

I'm getting the below error when running CI/CD pipeline in GitLab. $ echo "$GCLOUD_SERVICE_KEY" > ${HOME}/gcloud-service-key.json $ gcloud auth activate-service-account gitlabci@bizao-hub.iam....
GihanS's user avatar
  • 131
0 votes
0 answers
26 views

What sort of authentication is a windows machine local group with a domain user added to it?

I went and looked at a service that was run by a domain user. The process for the service read from a file on the machine's hard drive, and in the ACLs for that service there was an ACE for the local ...
leeand00's user avatar
  • 4,869
0 votes
2 answers
9k views

Service account does not have storage.buckets.create access

I have created a Service Account for Terraform. Apart of our process is to create some storage buckets and maintain them through Terraform. However, when we run terraform apply we get the following ...
Andrew Ellis's user avatar
3 votes
1 answer
3k views

How to use JSON keys with google cloud gsutil to manage multiple Keys

We have multiple GCP Service account keys from different environment such as DEV,STAGING,..PROD. I would like to run a command in my jenkins box which is there in Dev environment to create access DEV ...
Dinesh SC's user avatar
3 votes
1 answer
3k views

Why Domain Admin Cannot Enable Domain Wide Delegation for Service Accounts?

We need to use service accounts for our application instead of individually end users to call some Google Apis such as Admin Directory Api. There are 3 members of this project which are me as owner, ...
AshleyCam's user avatar
1 vote
1 answer
58 views

Windows - Restrict ability to run application to one service account

I've been asked to write a script that enters information from one application into another - and I've done it using a combination of Python, Selenium and Firefox (it's a temporary measure before a ...
Kate Hanahoe's user avatar
4 votes
2 answers
1k views

Deploying as service account (using `gcloud app deploy`) gives “API [appengine.googleapis.com] not enabled on project [%id%].”

I am struggling to make automated deployment using a service account work. First I created a new service account and now I am using a default %my-project-name%@appspot.gserviceaccount.com because ...
Evgeny's user avatar
  • 41
0 votes
0 answers
138 views

Configure Windows Service user account based on Domain Controller check

We have a patching service which is a windows service that patches the non domain controller and domain controllers. Currently we were using same service account(account_abc) which has a Domain ...
WonderHeart's user avatar
0 votes
1 answer
632 views

How to monitor service account activities in google cloud platform

I created more than 5 service account in GCP to use Pub/Sub services. Now, I want to delete 4 of the 5 accounts. But I don't know which 4 accounts are not using, which one is active. I don't want to ...
Chris's user avatar
  • 1
2 votes
1 answer
3k views

SPN generation for multiple service account on a Web server

I am trying to achieve Azure SSO in my organisation. I have a web server hosting multiple websites and web application under those sites. Users access them in below fashion https:// < SiteName >...
Dheeraj Kumar's user avatar
2 votes
1 answer
4k views

How to provide access to only one instance to users in Google Compute Engine?

I'm trying to find a solution to provide an external worker access to an instance in our project but not all resources. I have done some research and found two methods on how to do this. First ...
rung94's user avatar
  • 23
4 votes
4 answers
6k views

How to manage logon as service right for virtual account in face of domain group policy?

I would like to use the default SQL Server setup that runs SQL Server service with virtual account NT SERVICE\MSSQLSERVER. That ensures my SQL Server has limited access on its own machine and no ...
Bob Hyman's user avatar
2 votes
0 answers
2k views

Behaviour of environment variables in HKCU\Volatile Environment reg key

I have a .bat script that runs for every user at login (copies Oracle Java Exception Sites). It copies a file to: %userprofile%\appdata\LocalLow\Sun\Java\Deployment\security\exception.sites ...
uniquegeek's user avatar
3 votes
1 answer
1k views

Group Managed Service Accounts per service per server (Best practice?) and long names?

I've talked with a few colleagues about what might be best practice for using group managed service accounts in our environment. It seems that ideally, we would create 1 gMSA per service (e.g. SQL ...
Michael's user avatar
  • 141
4 votes
1 answer
708 views

Giving permissions to Virtual Service Accounts on domain controllers

The service I'm implementing will run on a domain controller, so I'd like it to have minimal privileges. Ideally, it would simply run as Local Service. However, it needs to be able to: monitor ...
YaronK's user avatar
  • 141
12 votes
1 answer
3k views

Scheduled restart of a service with powerhshell as non-admin service account

Before I get shot down, I know how to schedule a task, restart a service with powershell or give a non-admin account the privileges to restart a service. That isn't the problem. The problem however is ...
VolrathTheFallen's user avatar
1 vote
0 answers
68 views

vCenter Log on as a Service Concerns

I was installing VMWare vCenter Server 6.0 on Windows Server 2012 R2 when I came across vCenter Server Service Account feature. I can use a local system account or specify a service account on my ...
SuperAdmin's user avatar
1 vote
1 answer
272 views

Why Apache can run a command and root cannot?

I have a server-side script executed by Apache running as www-data. The script runs fine on the server when called remotely (http://example.com/script.sh). I am trying to run the same script on the ...
WoJ's user avatar
  • 3,577
0 votes
1 answer
62 views

How can I deny a local (non-domain) user the ability to log on without using group policy?

I have a workstation, running Windows 8.1, that is joined to a domain. I want to create a local (non-domain) user without the ability to log on interactively. I'd like to avoid Group Policy because ...
Micah R Ledbetter's user avatar
0 votes
1 answer
90 views

How to create an account, that can not login?

Our Unix systems rely on corporate AD for authentication and authorization. We need to create a few "role" accounts, which shall not be able to login themselves, but to which other accounts (...
Mikhail T.'s user avatar
  • 2,282
0 votes
1 answer
5k views

Cannot schedule task to run as user on Server 2012 R2

I'm trying to create a scheduled task on Server 2012 R2 to run as a domain service account. I select "Run whether the user is logged on or not", and select the domain service account, click on OK, ...
Drew Chapin's user avatar
5 votes
1 answer
2k views

What are the attributes of a Service Account?

What settings in AD make a service account, a service account? I know that the login into probably shouldn't be given to anyone but the administrators, that it might be used to run a service, I also ...
leeand00's user avatar
  • 4,869