GCP: Compute Engine Default Service Account missing

Question

I tried to deploy an OpenVPN Access Server to Google Compute Engines and received the following error message:

openvpn-access-server-1-vm: {"ResourceType":"compute.v1.instance","ResourceErrorCode":"EXTERNAL_RESOURCE_NOT_FOUND","ResourceErrorMessage":"The resource '[email protected]' of type 'serviceAccount' was not found."}

PROJECT_ID is just a placeholder for my own PROJECT_ID.

In the cloud console, I can't find the "compute engine default service account" (I think, I accidentally deleted it last year). In the log files, I found in 2020 it's ACCOUNT_ID, so I tried to undelete it with the following command:

gcloud beta iam service-accounts undelete ACCOUNT_ID

I had no success, I received:

ERROR: (gcloud.beta.iam.service-accounts.undelete) NOT_FOUND: Not found; Not found AccountDataType for <numeric_id>

<numeric_id> was a 12-digit number.

I tried to disable and enable compute service to restore the default service account, but it wasn't successful, I received:

response:
'@type': type.googleapis.com/google.iam.admin.v1.ServiceAccount
serviceName: iam.googleapis.com
status:
code: 6
message: ALREADY_EXISTS
receiveTimestamp: '2021-08-05T06:45:55.798772716Z'

Because of this error, I tried to delete it, but this didn't work too.

Now I don't know what to do, to get the default service account back. Is it still existing or not? Why isn't it working?

Keep in mind, I'm talking about [email protected]. [email protected] is existing and recreated each time I disable and enable the Compute Engine API again.

Thanks for helping.

Ashish Ashish · Accepted Answer · 2021-08-05T14:22:49

Since the Service Account was deleted an year ago it cannot be undeleted using the following command,

gcloud beta iam service-accounts undelete ACCOUNT_ID

This only works for Service Accounts deleted fewer than 30 days ago. Undeleting a service account for more information.

Instead, we can create a new Service Account and grant an ‘Editor’ role to it. As a Default Compute Engine Service Account has the same role by default. Compute Engine default service account for more information.

Now, we can create a new Compute Engine VM using the new Service Account. Setting up a new instance to run as a service account for more information.

If we already have a running VM and the Service Account got deleted, As @John Hanley suggested, we can edit the VM instance in the Google Cloud Console and assign the new Service Account to the instance. Changing the service account and access scopes for an instance for more information.

To set the new Service Account as the Compute Engine Default Service Account on the project, we can use the following command,

gcloud alpha compute project-info set-default-service-account

But since the command is in the ‘alpha’ launch stage, it is not available for everyone.

Another workaround would be creating a new project and deploying our instance there.

GCP: Compute Engine Default Service Account missing

1 Answers