Cloudera Docs

Creating provisioning credential's service account and generate access key

Create a service account and generate a JSON access key.

Review the permissions in Permissions for the provisioning credential's service account to learn what IAM permissions and IAM roles you need to assign to the service account that you will create.

  1. Log in to your Google Cloud account.
  2. Go to the project used for Cloudera.
  3. Go to IAM & Admin.
  4. Create a custom role.
    1. Go to the Roles page.
    2. Click + Create Custom Role.
    3. Enter a role title.
    4. Enter a role ID.
    5. Click + Add Permissions.
    6. Add the required granular permissions.
    7. Repeat steps 1-6 to add all the required permissions.
    8. Click Create.
  5. Create a service account.
    1. Go to the Service accounts page.
    2. Click Create service account.
    3. Enter a service account name.
    4. Click Create.
    5. Under Grant this service account access to project, choose the IAM roles to grant to the service account on the project. You need to assign all of the roles listed in Table 2.
    6. When you have added all the required roles, click Done to finish creating the service account.
  6. Generate an access key.
    1. Once your account has been created, find the row of the service account requiring a key. Click the (context menu) button in that row, and then click Create.
    2. Under Key type, select JSON and click Create.
    3. Click Create to download the service account key file. You will use the JSON access key to register the service account as a credential in Cloudera.
  7. Additionally, once you create the Logger service accounts, you need to update each of these two service accounts to grant the provisioning service account the Service Account User (iam.serviceAccountUser) role. The instructions are provided as part of Minimum setup for cloud storage.