Using a Service Account Key

By request, CTA may provision you a Service Account key. If you are interested in a Service Account key, contact help@techallies.org.

Service Account keys are required when performing workloads outside of Google Cloud and, sometimes, when making requests from one project to another project.

If CTA has notified you that a Service Account key has been provisioned, here's how to obtain and use it:

1. CTA stores Service Account keys securely and privately in 1Password vaults. Navigate to your 1Password vault to find the key. If you need help accessing your 1Password vault, contact help@techallies.org.
   
   
2. Once you have access to your key, you'll need to decode it. CTA uses base64 encoding on keys to make them easier to copy and paste:

   echo <text copied from 1Password note> | base64 -d > example_key.json

3. If you have the gcloud cli SDK installed, you can verify that your key is working as expected by activating the associated Service Account and confirming your permissions. For example, if the Service Account associated with the key provided should grant you access to listing datasets in BigQuery for project cta-project, then this example should work:

   gcloud auth activate-service-account --key-file=example_key.json
   Activated service account credentials for: [bq-partner@cta-project.iam.gserviceaccount.com]
   
   bq ls \
   --max_results 100 \
   --project_id cta-project
         datasetId
    -------------------
     sample_dataset
     sample_dataset_us
     writebox

If you do not have the gcloud cli SDK installed, CTA recommends following the steps here to install the appropriate version for your operating system.