Service account impersonation with gcloud: no key files needed

TL;DR

Instead of creating and downloading a service account key (which then needs storing, rotating, and never leaking), impersonate the service account with your own user credentials.

Steps

1. Instead of creating and downloading a service account key (which then needs storing, rotating, and never leaking), impersonate the service account with your own user credentials.

gcloud storage buckets list --impersonate-service-account [SA-EMAIL]

2. Or set it for the whole config:

gcloud config set auth/impersonate_service_account [SA-EMAIL]

3. What you need on the target service account: the iam.serviceAccounts.getAccessToken permission, which comes with roles/iam.serviceAccountTokenCreator (Service Account Token Creator). Grant it to your user or your CI identity:

gcloud iam service-accounts add-iam-policy-binding [SA-EMAIL] --member user:[YOUR-EMAIL] --role roles/iam.serviceAccountTokenCreator

4. Why impersonation beats keys:

• No secret material to store. The tokens are short-lived and minted on demand.
• Revoking is one IAM binding change, not a key hunt across repos and laptops.
• Audit logs show who impersonated whom.

5. Limits to know:

• Impersonated tokens last about an hour by default. Long-running jobs should mint fresh tokens or use a directly attached service account.
• The impersonating identity still needs the underlying API permissions through the service account; impersonation only changes WHO you act as, not WHAT you can do.
• Some tools that shell out to gcloud inherit the flag fine; tools that need raw ADC need the client-library impersonation path instead (see the companion skill).

6. Verify: run a read-only command with the flag and check the caller identity in the audit log, or use gcloud auth print-identity-token with impersonation to inspect claims.

When to use

You are seeing this: Grant it to your user or your CI identity: gcloud iam service-accounts add-iam-policy-binding [SA-EMAIL] --member user:[YOUR-EMAIL] --role roles/iam.serviceAccountTokenCreator Why impersonation beats keys: - No secret material to store. Use this skill when you run into "Service account impersonation with gcloud: no key files needed".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Verified 2026-09-26 on the impersonation docs: the --impersonate-service-account flag, the auth/impersonateserviceaccount property, and the roles/iam.serviceAccountTokenCreator requirement with iam.serviceAccounts.getAccessToken. This is the key-hygiene pattern agents should default to.