Enable Service Account Key Creation in Google Cloud Console

Enable Service Account Key Creation in Google Cloud Console

Step 1 — Check for Blocking Policies

In Google Cloud Console, switch to your project.

Go to IAM & Admin → Organization policies.

Search for Disable service account key creation.

If two entries appear (one with .managed and one without), note their enforcement status.

Step 2 — Get Required Permissions

Ask an administrator to grant you Organization Policy Administrator (roles/orgpolicy.policyAdmin) or Organization Administrator (roles/resourcemanager.organizationAdmin) at the organization level.

Ensure you also have Service Account Admin (roles/iam.serviceAccountAdmin) or Editor (roles/editor) at the project level.

Step 3 — Override the Managed Constraint

In Organization policies, search for iam.managed.disableServiceAccountKeyCreation.

Click it, then select Manage policy.

Choose Override parent’s policy and set Enforcement to Off.

Click Save.

Step 4 — Override the Legacy Constraint

Search for iam.disableServiceAccountKeyCreation in Organization policies.

Click it, then select Manage policy.

Choose Override parent’s policy and set Enforcement to Off.

Click Save.

Info
Service Account Keys may now be created, if you were following instructions elsewhere you can resume those instructions.

Step 5 — Create a Service Account Key

Go to IAM & Admin → Service accounts.

Open your service account and go to the Keys tab.

Click Add key → Create new key → JSON.

Download and store the key securely.

Step 6 — Security Best Practices

Never commit JSON keys to public repositories.

Store keys in a secure secret manager.

Rotate or delete unused keys regularly.

    • Related Articles

    • Configuring Google Workspace for eSilo Backup

      To add your Google Workspace organization to the eSilo Cyber Protection service by using a dedicated Google Cloud project, you need to do the following: Create a new Google Cloud project. Enable the required APIs for this project. Configure the ...

    • Recovering Google Workspace Backup Data

      Accessing the eSilo Cyber Protect Console To get started recovering your data, you'll first need to login to the web console by going to console.esilo.com in your web browser. Once there, you'll be prompted for your login credentials, for most users ...

    • Management Agent Service Will Not Start

      'VeeamManagementAgentSvc' is not running. Attempts to Start this service are unsuccessful. Possible Symptoms of this Problem: Host is showing ‘Offline’ in eSilo Backup Portal despite being powered on with network connectivity. Cloud connect backups ...

    • Recovering Files and Folders Using the Cyber Protect Console

      This article explains how to recover files or folders to a computer via the web console at console.esilo.com. This method assumes the computer you are recovering files to is working and connected to the internet. To recover an entire disk or a ...

    • Upgrade Veeam Backup & Replication Console, for Remote Access to VBR

      How to upgrade Veeam Backup & Replication Console used to remotely connect to a tenant backup server (VBR) or to eSilo’s backup server (Veeam Cloud Connect Server). When to use this article: If you use the Veeam Backup & Replication Dashboard to ...