Glossary term
Service account impersonation
A principal obtaining short-lived credentials for a Google Cloud service account through the IAM Credentials API instead of a key. Logged with delegation info.
Service account impersonation is the act of a user or another service account obtaining credentials for a service account: an access token (GenerateAccessToken), an ID token, or a signature (SignBlob, SignJwt), through iamcredentials.googleapis.com. It requires permissions such as iam.serviceAccounts.getAccessToken, included in the Service Account Token Creator role.
The minting call is a Data Access audit log. Calls made with the token list the real caller in authenticationInfo.serviceAccountDelegationInfo, which can contain a whole chain. Impersonation is recommended over keys, but broad Token Creator grants make it a classic privilege-escalation path.