Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Concept
service accounts
Topic in 3 exam domains
- service accounts · Concept
- service accounts · Feature
- service-accounts · Feature · gcloud edge-cloud command group
- service-accounts · Concept · gcloud iam group
- Service Accounts · Concept · Distributed Cloud Edge Container
- Service accounts · Concept · Google Ads transfer configuration authorization
Also called: API-only service accounts, BigQuery service account, custom service accounts, GCP service account, IAM service account, service account, source service accounts, target service accounts
Identities used by applications and virtual machine instances to make authorized calls to Google Cloud APIs.
Where this appears on the exam
3 subdomains in 3 of 5 domains
~22% of exam
~25% of exam
~15% of exam
Related topics
FoundationsBuilding blocksThis topicWorks alongsideBuilds on theseAppliedIAMServiceIdentity and Access ManagementServiceLookerServiceprojectConceptPub/SubServiceIAM rolesConceptrolesConceptCloud StorageServiceservice accountConcept
service accountsConcept
Workload Identity FederationFeatureCloud Data FusionServiceBigQueryServiceCloud Storage bucketConceptservice account keyConceptservice account keysConceptBigQuery Data Transfer ServiceServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- BigQuery Data Transfer Service works with service accounts From the official documentation: “Use service accounts with BigQuery Data Transfer Service”
- Cloud Data Fusion depends on service accounts From the official documentation: “A service account provides an identity for Cloud Data Fusion, which gives Cloud Data Fusion access to your resources.”
- IAM secures service accounts From the official documentation: “Authorized access: to ensure that only authorized service accounts can query external data, use Identity and Access Management (IAM) for centralized access control.”
- IAM roles configures service accounts From the official documentation: “You must grant specific IAM roles to the AlloyDB cluster service account to define which datasets and tables can be queried.”
- Identity and Access Management configures service accounts From the official documentation: “To manage this access, you grant specific Identity and Access Management (IAM) roles to the service accounts that receive events and invoke your target workloads.”
- roles configures service accounts From the official documentation: “To manage permissions within your project, you grant roles to individuals and service accounts.”
- service account key is part of service accounts From the official documentation: “Managing service identities involves both the service identity (represented by a `ProjectServiceAccount` resource) and its associated credentials (public and private key pairs).”
- service account keys depends on service accounts From the official documentation: “A [service account key](/iam/docs/service-account-overview) lets you authenticate a request as a service account.”
- service accounts is part of Identity and Access Management From the official documentation: “The Organization Policy Service provides constraints that can be used in [organization policies](/organization-policy/overview) to limit the usage of Identity and Access Management (IAM) [service accounts](/iam/docs/service-accounts).”
- service accounts is part of Looker From the official documentation: “On January 12, 2026, we introduced service accounts in Looker (original) to help manage workflows for API credentials.”
- service accounts is part of project From the official documentation: “Service accounts are owned by projects, and you can create many service accounts for a project.”
- BigQuery is an alternative to Cloud Storage From the official documentation: “The `import_result_sink` must be a Cloud Storage path or a BigQuery table.”
- BigQuery works with Cloud Storage From the official documentation: “Sample to load Avro data from Cloud Storage into a new BigQuery table”
- BigQuery works with BigQuery Data Transfer Service From the official documentation: “The BigQuery Data Transfer Service uses load jobs to load Amazon S3 data into BigQuery.”
- service account keys is an alternative to Workload Identity Federation From the official documentation: “Where possible, consider using Workload Identity Federation instead of service account keys.”
- BigQuery works with Looker From the official documentation: “Connect Looker to the BigQuery project.”
- service account key is an alternative to Workload Identity Federation From the official documentation: “Workload Identity Federation lets you access Google Cloud resources from outside of Google Cloud without using a service account key.”
- Cloud Storage is an alternative to Pub/Sub From the official documentation: “To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub.”
- BigQuery works with Pub/Sub From the official documentation: “createBigQuerySubscription creates a Pub/Sub subscription that exports messages to BigQuery.”
- Cloud Storage works with Pub/Sub From the official documentation: “| **Google Cloud** | Cloud Storage | Pub/Sub |”
- service account works with Workload Identity Federation From the official documentation: “When an application uses Workload Identity Federation, it impersonates a service account.”
- service account key is part of service account From the official documentation: “Create a service account key:”
- BigQuery is an alternative to Pub/Sub From the official documentation: “To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub.”
- BigQuery Data Transfer Service works with Cloud Storage From the official documentation: “- [Cloud Storage](/bigquery/docs/cloud-storage-transfer)”
- Cloud Storage bucket is part of Cloud Storage From the official documentation: “Create a Google Cloud Storage bucket”
- IAM roles is part of Identity and Access Management From the official documentation: “IAM roles give the principals permissions to perform tasks on your App Topology resources.”
- Identity and Access Management secures Cloud Storage From the official documentation: “Cloud Storage uses Identity and Access Management (IAM) for authorization.”
- service account is part of Identity and Access Management From the official documentation: “Service accounts function as both principals and resources within IAM.”
- BigQuery works with Cloud Data Fusion From the official documentation: “Cloud Data Fusion pulls data from the storage bucket and writes it to BigQuery.”
- BigQuery works with Identity and Access Management From the official documentation: “BigQuery uses Identity and Access Management (IAM) for authorization.”
- BigQuery Data Transfer Service works with Pub/Sub From the official documentation: “If you intend to set up transfer run notifications for Pub/Sub, you must have `pubsub.topics.setIamPolicy` permissions.”
- BigQuery Data Transfer Service works with service account From the official documentation: “BigQuery Data Transfer Service lets you authenticate data transfers for supported data sources by using a [service account](/iam/docs/service-account-overview) instead of individual user credentials.”
- Cloud Storage works with service account From the official documentation: “The service account can manage objects in the Cloud Storage bucket.”
- IAM secures BigQuery From the official documentation: “BigQuery uses IAM to manage access to resources.”
- IAM roles works with service account From the official documentation: “In this section, you designate the service account for the gateway proxies and assign them the correct IAM roles.”
- IAM roles configures service account From the official documentation: “2. [Grant the necessary Identity and Access Management roles](#grant-iam-roles) to your service account.”
- Pub/Sub works with service account From the official documentation: “5. Creates a service account to represent the Pub/Sub subscription identity.”
- service account works with service account key From the official documentation: “You can authenticate the service account using Application Default Credentials (ADC) or a service account key.”
- service account keys is part of service account From the official documentation: “You use the Identity and Access Management API to create a new key pair for a service account.”
- BigQuery depends on Cloud Storage From the official documentation: “BigQuery relies on Cloud Storage for staging file data and supports reading from and writing to several other sources and Google Cloud services.”
- BigQuery works with Cloud Storage bucket From the official documentation: “BigQuery lets you load [Datastore](/datastore) entities from a Cloud Storage bucket into a BigQuery table for analysis.”
- BigQuery works with service account From the official documentation: “The service account can be used by services, such as Cloud Run, to read and modify data in the BigQuery dataset.”
- BigQuery Data Transfer Service depends on Cloud Storage bucket From the official documentation: “This bucket is used by the BigQuery Data Transfer Service as a staging area for data files to be ingested into BigQuery.”
- BigQuery Data Transfer Service depends on Pub/Sub From the official documentation: “The communication channel between the agent running on premises and BigQuery Data Transfer Service is by publishing Pub/Sub messages to a per transfer topic.”
- Cloud Data Fusion works with Pub/Sub From the official documentation: “This page describes how to publish Cloud Data Fusion pipeline events, such as pipeline status, to Pub/Sub topics.”
- Cloud Storage works with IAM From the official documentation: “Use IAM and Cloud Storage Terraform resources to create a public Cloud Storage bucket.”
- Cloud Storage works with Identity and Access Management From the official documentation: “To learn how to use IAM with Cloud Storage, see [Using IAM Permissions](/storage/docs/access-control/using-iam-permissions).”
- Cloud Storage is part of project From the official documentation: “All of your Google Cloud resources belong to a project, including Cloud Storage resources like buckets and objects.”
- IAM configures Cloud Storage From the official documentation: “Apply IAM policies consistently across all relevant assets and resources in your AI and ML systems, including the following: - Cloud Storage buckets that contain sensitive data or model artifacts.”
- IAM configures Cloud Storage bucket From the official documentation: “IAM controls permissioning throughout Google Cloud and lets you grant permissions at the bucket and project levels.”
- IAM works with Pub/Sub From the official documentation: “Pub/Sub relies on a standard OAuth authentication used by other Google Cloud products and supports granular IAM, enabling access control for individual resources.”
- IAM secures Pub/Sub From the official documentation: “Access control with IAM Learn how Pub/Sub uses IAM for access control.”
- IAM roles secures Cloud Storage From the official documentation: “**Fine-grained access control**: Control agent access to Cloud Storage precisely using [IAM roles](/storage/docs/access-control/iam-roles).”
- IAM roles configures Cloud Storage bucket From the official documentation: “Provide your instance with the `storage.objectAdmin` and `objectViewer` [IAM roles](/storage/docs/access-control/iam-roles) for your bucket.”
- Identity and Access Management secures BigQuery From the official documentation: “Security in BigQuery is intrinsically linked to [Identity and Access Management (IAM)](/iam/docs/overview) in Google Cloud.”
- Identity and Access Management secures Cloud Data Fusion From the official documentation: “Cloud Data Fusion uses Identity and Access Management (IAM) for authorization.”
- Identity and Access Management configures Cloud Storage bucket From the official documentation: “You can use [Identity and Access Management (IAM)](/storage/docs/access-control/iam) to control access to individual buckets.”
- Identity and Access Management secures Cloud Storage bucket From the official documentation: “These modifications to that file define a second backup repository in a Cloud Storage bucket, accessed through Identity and Access Management (IAM).”
- Identity and Access Management secures Pub/Sub From the official documentation: “Pub/Sub uses Identity and Access Management (IAM) for authorization.”
- roles is part of Looker From the official documentation: “If you need to, Looker lets you create roles to manage which users have access to features and data.”
How learners score on this topic
Last updated