LCA as Google functions: Identity and Access Management
Learn how to manage service accounts and configure permissions for Identity and Access Management (IAM) in the Google Cloud Console.
Manage who can impersonate your service account by controlling access in the "Grant users access to this service account" section to enhance security.
We recommend that you:
- Always adhere to the principle of least privilege by granting minimal necessary access to service accounts.
- Regularly review and update permissions to ensure ongoing security and compliance.
Open a Support ticket requesting a Reltio service account for impersonation. Include:
Environment name
Tenant ID
- Log in to the Google Cloud Console. Ensure you are signed in with an account that has the necessary permissions to manage service accounts.
- Select an existing project or create a new one.
- Select IAM & Admin and then select Service Accounts.
- Create the service account by selecting the + CREATE SERVICE ACCOUNT
- At the top of the page, provide a name and description for the service account
- Select CREATE.
- Assign the following roles to the service account:
- Cloud Run Invoker to invoke the Google function if it is already deployed or will be deployed using another service account.
- Cloud Functions Developer and Storage Object Admin to deploy a Google function.
- Select CONTINUE and DONE to complete the setup.
- Navigate to to configure Reltio impersonation permissions.
- Select the service account that you want the source account to impersonate.
- Navigate to Permissions and then View by Principals.
- Select + GRANT ACCESS.
- Enter the email address of the service account provided by Reltio in the Add principals field and assign the following roles:
- Service Account User to allow the source account to impersonate the target account.
- Service Account Token Creator if the source needs to generate tokens for authentication or authorization purposes.
- Select SAVE to apply the new permissions.Attention: Once the service account is created, share the service account email with Reltio Support for setup.