Glossary term
Service account
A non-human Google Cloud identity used by workloads such as VMs, CI pipelines and functions. Its email ends in gserviceaccount.com; it holds IAM roles.
A service account is a Google Cloud identity for workloads rather than people. User-created service accounts have emails like name@PROJECT.iam.gserviceaccount.com; Google-managed service agents use other gserviceaccount.com domains. A service account receives IAM roles like any principal.
Workloads obtain its credentials in three main ways: attached to a resource (a VM gets tokens from the metadata server), through impersonation by another principal, or with a downloadable service account key. In audit logs it appears in authenticationInfo.principalEmail. Because they are often over-privileged and their credentials leak, service accounts are the most common entry point in Google Cloud compromises.