> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/unified-identities/gcp-identities/service-accounts.md).

# Service Accounts

The `Service Accounts` page provides a list of enumerated Service Accounts in GCP.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-f093ed139baaed624992c05b3b1105a4e75bf563%2FGCPServiceAccountsListPage.png?alt=media" alt=""><figcaption><p>Service Accounts</p></figcaption></figure>

## Service Accounts Details

The Details page includes the `Details`, `Service Account Keys` and `VMs` tabs, and a `Visualize` button for enhanced navigation and analysis. Each tab except `Details` carries the number of rows it holds in its label.

{% hint style="info" %}
You can analyze objects in the `Graph module` by clicking the `Visualize` button on the upper left side.
{% endhint %}

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-23da2125b716b86be6cfe53c1644386eb8ad1357%2FGCPServiceAccountsDetailPage.png?alt=media" alt=""><figcaption><p>Service Account Details</p></figcaption></figure>

## Information

The Details tab contains attributes about the GCP Service Account. Risk and Exposure scores are displayed at the top of the page, along with privilege badges such as **Tier 0** and **Privileged**. An **Issues** panel on the right lists detected security findings.

| Attribute          | Description                                                                                                                               |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- |
| Display Name       | The human-readable name of the service account (e.g., `Forestall Privileged`).                                                            |
| Service Account ID | The full email-format identifier of the service account (e.g., `forestall-privileged@management-project-486413.iam.gserviceaccount.com`). |
| Name               | The full resource name of the service account.                                                                                            |
| Parent Project     | The GCP project this service account belongs to.                                                                                          |
| Unique ID          | The unique numeric identifier of the service account.                                                                                     |
| Email              | The email address associated with the service account, used for IAM bindings.                                                             |
| Description        | A text description of the service account's purpose.                                                                                      |
| Disabled           | Indicates whether the service account is currently disabled.                                                                              |
| OAuth2 Client ID   | The OAuth2 client ID associated with the service account, used for authentication flows.                                                  |

### Service Account Keys

List all **Service Account Keys** binded to that service account.

### VMs

VMs tab contains a list of the Compute Engine instances that run as this service account.

An instance running as a service account can obtain that account's token from the metadata server, so anyone with access to the instance inherits everything the service account can do. This tab answers the question the other way round from the usual one: not what the service account may reach, but which machines can act as it.