# Optionally set as active account if $SET_ACTIVE; then gcloud config set account "$SA_EMAIL" log_info "✓ Set as active account" fi

log_info "Authenticating service account: $SA_EMAIL" GCLOUD_CMD="gcloud auth activate-service-account $SA_EMAIL --key-file=$KEY_FILE"

# 1. Set restrictive permissions on key file chmod 600 service-account-key.json 2. Use Workload Identity Federation when possible (instead of keys) https://cloud.google.com/iam/docs/workload-identity-federation 3. Rotate keys regularly gcloud iam service-accounts keys list --iam-account=$SA_EMAIL gcloud iam service-accounts keys delete KEY_ID --iam-account=$SA_EMAIL 4. Audit key usage gcloud logging read "protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey"" 5. Use temporary credentials gcloud auth print-access-token --impersonate-service-account=$SA_EMAIL 9. Troubleshooting Common Issues & Solutions | Issue | Solution | |-------|----------| | Permission denied | Check IAM roles: gcloud projects get-iam-policy PROJECT_ID | | Invalid JSON | Validate key: jq . key.json | | Token expired | Re-authenticate: gcloud auth revoke && gcloud auth activate... | | Project not set | Set project: gcloud config set project PROJECT_ID | | Quota exceeded | Check quota: gcloud services quota list | Debug Commands # Enable debug logging gcloud auth activate-service-account --key-file=key.json --log-http Check environment gcloud info --run-diagnostics List all active accounts gcloud auth list --filter="status=ACTIVE" 10. Cleanup & Logout # Revoke service account access gcloud auth revoke $SA_EMAIL Remove all credentials gcloud auth revoke --all Clear application default credentials rm -f ~/.config/gcloud/application_default_credentials.json This feature provides a complete, production-ready implementation for authenticating with service accounts in Google Cloud, suitable for automation, CI/CD, and secure deployments.

log_info() echo -e "$GREEN[INFO]$NC $1"; log_warn() echo -e "$YELLOW[WARN]$NC $1"; log_error() echo -e "$RED[ERROR]$NC $1"; KEY_FILE="" PROJECT_ID="" VERBOSE=false SET_ACTIVE=true Parse arguments while [[ $# -gt 0 ]]; do case $1 in --key-file|-k) KEY_FILE="$2" shift 2 ;; --project|-p) PROJECT_ID="$2" shift 2 ;; --verbose|-v) VERBOSE=true shift ;; --no-set-active) SET_ACTIVE=false shift ;; --help|-h) cat << EOF Usage: $0 [OPTIONS]

Gcloud Login With Service Account ((install)) Guide

# Optionally set as active account if $SET_ACTIVE; then gcloud config set account "$SA_EMAIL" log_info "✓ Set as active account" fi

log_info "Authenticating service account: $SA_EMAIL" GCLOUD_CMD="gcloud auth activate-service-account $SA_EMAIL --key-file=$KEY_FILE" gcloud login with service account

# 1. Set restrictive permissions on key file chmod 600 service-account-key.json 2. Use Workload Identity Federation when possible (instead of keys) https://cloud.google.com/iam/docs/workload-identity-federation 3. Rotate keys regularly gcloud iam service-accounts keys list --iam-account=$SA_EMAIL gcloud iam service-accounts keys delete KEY_ID --iam-account=$SA_EMAIL 4. Audit key usage gcloud logging read "protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey"" 5. Use temporary credentials gcloud auth print-access-token --impersonate-service-account=$SA_EMAIL 9. Troubleshooting Common Issues & Solutions | Issue | Solution | |-------|----------| | Permission denied | Check IAM roles: gcloud projects get-iam-policy PROJECT_ID | | Invalid JSON | Validate key: jq . key.json | | Token expired | Re-authenticate: gcloud auth revoke && gcloud auth activate... | | Project not set | Set project: gcloud config set project PROJECT_ID | | Quota exceeded | Check quota: gcloud services quota list | Debug Commands # Enable debug logging gcloud auth activate-service-account --key-file=key.json --log-http Check environment gcloud info --run-diagnostics List all active accounts gcloud auth list --filter="status=ACTIVE" 10. Cleanup & Logout # Revoke service account access gcloud auth revoke $SA_EMAIL Remove all credentials gcloud auth revoke --all Clear application default credentials rm -f ~/.config/gcloud/application_default_credentials.json This feature provides a complete, production-ready implementation for authenticating with service accounts in Google Cloud, suitable for automation, CI/CD, and secure deployments. # Optionally set as active account if $SET_ACTIVE;

log_info() echo -e "$GREEN[INFO]$NC $1"; log_warn() echo -e "$YELLOW[WARN]$NC $1"; log_error() echo -e "$RED[ERROR]$NC $1"; KEY_FILE="" PROJECT_ID="" VERBOSE=false SET_ACTIVE=true Parse arguments while [[ $# -gt 0 ]]; do case $1 in --key-file|-k) KEY_FILE="$2" shift 2 ;; --project|-p) PROJECT_ID="$2" shift 2 ;; --verbose|-v) VERBOSE=true shift ;; --no-set-active) SET_ACTIVE=false shift ;; --help|-h) cat << EOF Usage: $0 [OPTIONS] Rotate keys regularly gcloud iam service-accounts keys list

About Us

gcloud login with service account

Located on the San Francisco Peninsula, we have approximately 1000 members.  

We offer a variety of games, classes and other educational programs.

We offer games for all levels of players including intermediate / newcomer games specifically for new and returning players with limited masterpoints. We hold regular club games Monday through Friday at our Bridge Center.  We also offer special weekend games several times a month.

We also offer a comprehensive education program including classes, free lectures, mentoring and celebrity seminars.