サービスアカウントの権限借用について

# プロジェクト ID を設定
export PROJECT_ID=YOUR_PROJECT_ID

# 現在の認証ユーザーを確認
gcloud auth list --filter=status:ACTIVE --format="value(account)"

user@example.com

# サービスアカウントを作成
gcloud iam service-accounts create sa-impersonation-demo \
  --display-name="Impersonation Demo SA" \
  --project=$PROJECT_ID

Created service account [sa-impersonation-demo].
Service account email: sa-impersonation-demo@my-project.iam.gserviceaccount.com

# サービスアカウントの確認
gcloud iam service-accounts describe \
  sa-impersonation-demo@$PROJECT_ID.iam.gserviceaccount.com \
  --project=$PROJECT_ID

displayName: Impersonation Demo SA
email: sa-impersonation-demo@my-project.iam.gserviceaccount.com
etag: MDEwMjE5MjA=
name: projects/my-project/serviceAccounts/sa-impersonation-demo@my-project.iam.gserviceaccount.com
oauth2ClientId: '012345678901234567890'
projectId: my-project
uniqueId: '012345678901234567890'

# サービスアカウントに Storage 閲覧者ロールを付与
gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="serviceAccount:sa-impersonation-demo@$PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/storage.viewer"

# 現在のユーザーアカウントを取得
export CALLER_ACCOUNT=$(gcloud auth list --filter=status:ACTIVE --format="value(account)")

# Service Account Token Creator ロールを付与
gcloud iam service-accounts add-iam-policy-binding \
  sa-impersonation-demo@$PROJECT_ID.iam.gserviceaccount.com \
  --member="user:$CALLER_ACCOUNT" \
  --role="roles/iam.serviceAccountTokenCreator"

Updated IAM policy for serviceAccount [sa-impersonation-demo@my-project.iam.gserviceaccount.com].
bindings:
- members:
  - user:user@example.com
  role: roles/iam.serviceAccountTokenCreator
etag: BwZYPpqB25Y=
version: 1

# 権限借用で Cloud Storage バケット一覧を取得
gcloud storage buckets list \
  --impersonate-service-account=sa-impersonation-demo@$PROJECT_ID.iam.gserviceaccount.com \
  --project=$PROJECT_ID

WARNING: This command is using service account impersonation. All API calls will be executed as [sa-impersonation-demo@my-project.iam.gserviceaccount.com].
---
creation_time: 2026-04-22T21:14:03+0000
default_storage_class: STANDARD
generation: 1776892443634164645
location: US-CENTRAL1
location_type: region
metageneration: 3
name: example-data-bucket
public_access_prevention: inherited
soft_delete_policy:
  effectiveTime: '2026-04-22T21:14:03.762000+00:00'
  retentionDurationSeconds: '604800'
storage_url: gs://example-data-bucket/
uniform_bucket_level_access: true
update_time: 2026-04-22T22:36:38+0000

# デフォルトの権限借用設定を有効化
gcloud config set auth/impersonate_service_account \
  sa-impersonation-demo@$PROJECT_ID.iam.gserviceaccount.com

Updated property [auth/impersonate_service_account].

# 以降のコマンドは自動的に権限借用で実行される
gcloud storage buckets list --project=$PROJECT_ID

---
creation_time: 2026-04-22T21:14:03+0000
default_storage_class: STANDARD
generation: 1776892443634164645
location: US-CENTRAL1
location_type: region
metageneration: 3
name: example-data-bucket
public_access_prevention: inherited
soft_delete_policy:
  effectiveTime: '2026-04-22T21:14:03.762000+00:00'
  retentionDurationSeconds: '604800'
storage_url: gs://example-data-bucket/
uniform_bucket_level_access: true
update_time: 2026-04-22T22:36:38+0000

# 設定を解除する場合
gcloud config unset auth/impersonate_service_account

Unset property [auth/impersonate_service_account].

# ADC に権限借用を設定
gcloud auth application-default login \
  --impersonate-service-account=sa-impersonation-demo@$PROJECT_ID.iam.gserviceaccount.com

Your browser has been opened to visit:

    https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=xxxxxxxxxxxxx-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com&redirect_uri=http%3A%2F%2Flocalhost%3A8085%2F&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcloud-platform&state=XXXXX&access_type=offline&code_challenge=XXXXX&code_challenge_method=S256

Credentials saved to file: [~/.config/gcloud/application_default_credentials.json]

These credentials will be used by any library that requests Application Default Credentials (ADC).

cat ~/.config/gcloud/application_default_credentials.json
{
  "delegates": [],
  "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/sa-impersonation-demo@my-project.iam.gserviceaccount.com:generateAccessToken",
  "source_credentials": {
    "account": "",
    "client_id": "xxxxxxxxx-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com",
    "client_secret": "d-FL95Q19q7MQmFpd7hHD0Ty",
    "refresh_token": "1//0eXXXXXXXXXXXXXX",
    "type": "authorized_user",
    "universe_domain": "googleapis.com"
  },
  "type": "impersonated_service_account"
}

# 権限借用なしでの認証情報を確認
gcloud auth print-access-token

ya29.a0XXXXXXXXXXXXXXX...

# 権限借用ありでの認証情報を確認（異なるトークンが返される）
gcloud auth print-access-token \
  --impersonate-service-account=sa-impersonation-demo@$PROJECT_ID.iam.gserviceaccount.com

WARNING: This command is using service account impersonation. All API calls will be executed as [sa-impersonation-demo@my-project.iam.gserviceaccount.com].
ya29.c.c0XXXXXXXXXXXXXXX...

{
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "status": {},
    "authenticationInfo": {
      "principalEmail": "sa-impersonation-demo@my-project.iam.gserviceaccount.com",
      "serviceAccountDelegationInfo": [
        {
          "firstPartyPrincipal": {
            "principalEmail": "user@example.com"
          }
        }
      ],
      "oauthInfo": {
        "oauthClientId": "012345678901234567890"
      }
    },
    "requestMetadata": {
      "callerIp": "XXX.XXX.XXX.XXX",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/575.0.1 command/gcloud.storage.buckets.list invocation-id/XXXXX environment/None environment-version/None client-os/LINUX client-os-ver/6.6.87 client-pltf-arch/x86_64 interactive/True from-script/False python/3.14.5 term/xterm-256color  (Linux 6.6.87.2-microsoft-standard-WSL2),gzip(gfe)",
      "requestAttributes": {
        "time": "2026-08-04T20:48:20.065782019Z",
        "auth": {}
      },
      "destinationAttributes": {}
    },
    "serviceName": "storage.googleapis.com",
    "methodName": "storage.buckets.list",
    "authorizationInfo": [
      {
        "permission": "storage.buckets.getIamPolicy",
        "granted": false,
        "resourceAttributes": {}
      },
      {
        "resource": "projects/_/buckets/example-deploy-bucket",
        "permission": "storage.buckets.getIamPolicy",
        "granted": false,
        "resourceAttributes": {}
      },
      {
        "resource": "projects/_/buckets/example-data-bucket",
        "permission": "storage.buckets.getIamPolicy",
        "granted": false,
        "resourceAttributes": {}
      }
    ],
    "resourceLocation": {
      "currentLocations": [
        "global"
      ]
    }
  },
  "insertId": "mtf5soeczw0v",
  "resource": {
    "type": "gcs_bucket",
    "labels": {
      "location": "global",
      "project_id": "my-project",
      "bucket_name": ""
    }
  },
  "timestamp": "2026-08-04T20:48:19.889815759Z",
  "severity": "INFO",
  "logName": "projects/my-project/logs/cloudaudit.googleapis.com%2Fdata_access",
  "receiveTimestamp": "2026-08-04T20:48:21.065422622Z"
}