如何通过IAM API为GCP生成的服务账号设置管理员权限？

Got it, let's walk through the concrete steps to assign admin-level permissions to your GCP service accounts now that you've pulled their info via the projects.serviceAccounts/list API. Here's what you need to do next:

1. Identify the Target Service Account(s) #

From the response of the list API, grab the email field for each service account you want to grant admin permissions to. This email (e.g., my-sa@my-project.iam.gserviceaccount.com) is the unique identifier you'll use in subsequent API calls.

2. Choose the Right Admin Role #

First, pick the appropriate admin role based on your needs:

• Full Project Admin: Use roles/owner (grants full access to all resources in the project)
• IAM Admin: Use roles/iam.admin (grants permission to manage IAM policies for the project/service accounts)
• Service Account Admin: Use roles/iam.serviceAccountAdmin (specifically for managing service accounts and their permissions)

3. Use the setIamPolicy API to Assign Permissions #

You'll call the projects.serviceAccounts.setIamPolicy endpoint to update the IAM policy for the target service account (or apply the policy at the project level if you want the service account to have admin access across the entire project).

Request Details: #

• Method: POST
• URL: https://iam.googleapis.com/v1/{name}:setIamPolicy
  • Replace {name} with the full resource name of the service account: projects/{PROJECT_ID}/serviceAccounts/{SA_EMAIL}
• Request Body: A JSON payload defining the IAM policy binding. Here's an example that adds the full project owner role to the service account:

{
  "policy": {
    "bindings": [
      {
        "role": "roles/owner",
        "members": [
          "serviceAccount:{SA_EMAIL}"
        ]
      }
    ]
  }
}

Note: If you want to preserve existing permissions instead of overwriting them, first fetch the current policy via projects.serviceAccounts.getIamPolicy, add your new binding to the existing bindings array, then send that updated policy in the setIamPolicy request.

4. Verify the Permissions Are Applied #

To confirm the permissions were assigned correctly, call the projects.serviceAccounts.getIamPolicy endpoint with the same service account resource name. Check the bindings section in the response to ensure your chosen admin role is listed for the service account.

Alternative: Use gcloud CLI (If Preferable) #

If you're more comfortable with the command line instead of raw API calls, you can run this command to grant a role directly:

gcloud projects add-iam-policy-binding {PROJECT_ID} \
  --member=serviceAccount:{SA_EMAIL} \
  --role=roles/owner

Important Prerequisite #

Make sure the account you're using to run these API calls/commands has the necessary permissions (like roles/iam.admin or roles/owner) to modify IAM policies in the target project.

内容的提问来源于stack exchange，提问作者bthe0