Service Account
An identity type in Google Cloud used for machine-to-machine authentication. It signs requests with a key pair and is suitable for automated workflows calling protected APIs.
Timeline (last 90 days)
A Service Account is an identity type in Google Cloud used for machine-to-machine authentication; it has no password and proves its identity through a pair of keys (a unique email address and a private key); when calling the Vertex AI API, a personal account usually cannot be used for interactive authorization, so a service account is the standard solution.
When calling Vertex AI in n8n, authentication follows the Service Account route: in n8n's predefined credentials → Google Cloud API, fill in the region, the service account email, and the scope URL.
Traditional machine identities typically exist in the form of service accounts or API keys, with relatively fixed permissions and lifecycles managed manually.
Traceability of the delegation chain is a capability that the traditional Service Account model lacks.
When training jobs are submitted on behalf of users by a platform service account, the service identity rather than the real user is recorded in the logs, resulting in an audit gap.
Guiding clients to create separate restricted service accounts for automation projects is one of the best practices for reducing the risk of credential leakage.
One best practice is to guide clients to create a dedicated service account for automation projects, granting only the minimum permissions necessary to complete the task, rather than sharing primary account credentials.
Guiding clients to create dedicated service accounts for automation projects and grant minimal permissions can limit the attack surface in the event of a credential leak.
All Facts (8)
A Service Account is an identity type in Google Cloud used for machine-to-machine authentication; it has no password and proves its identity through a pair of keys (a unique email address and a private key); when calling the Vertex AI API, a personal account usually cannot be used for interactive authorization, so a service account is the standard solution.
50%UnverifiedWhen calling Vertex AI in n8n, authentication follows the Service Account route: in n8n's predefined credentials → Google Cloud API, fill in the region, the service account email, and the scope URL.
50%UnverifiedTraditional machine identities typically exist in the form of service accounts or API keys, with relatively fixed permissions and lifecycles managed manually.
50%UnverifiedTraceability of the delegation chain is a capability that the traditional Service Account model lacks.
50%UnverifiedWhen training jobs are submitted on behalf of users by a platform service account, the service identity rather than the real user is recorded in the logs, resulting in an audit gap.
50%UnverifiedGuiding clients to create separate restricted service accounts for automation projects is one of the best practices for reducing the risk of credential leakage.
50%UnverifiedOne best practice is to guide clients to create a dedicated service account for automation projects, granting only the minimum permissions necessary to complete the task, rather than sharing primary account credentials.
50%UnverifiedGuiding clients to create dedicated service accounts for automation projects and grant minimal permissions can limit the attack surface in the event of a credential leak.
50%