GOOGLE SERVICE ACCOUNT
Stores a Google Cloud service-account credential, optionally with an HMAC key pair for object-storage access.
GOOGLE SERVICE ACCOUNT is the first entry in the Secret Type dropdown and it's available at all three scopes: User, Workspace and Tenant. The service-account key is the credential Google Cloud issues for a non-human identity, and we use it to authenticate against Google Cloud Storage and whatever else in the project the account has been granted.
The optional HMAC key pair exists for a narrower reason. Some object-storage clients speak the S3 protocol rather than the native Google Cloud Storage API, and those clients expect an access key and secret in the S3 style, which is exactly what an HMAC pair provides for a service account.
Supply it only if something in your workload actually requires that interface.
Basic Details
Common to every secret type:
| Field | Required | Control | Placeholder / default |
|---|---|---|---|
| Secret Name | Yes | text | title_example_user_secret_1 |
| Secret Type | Yes | dropdown | select GOOGLE SERVICE ACCOUNT |
| Workspace | Yes | dropdown | Workspace scope only |
| Description | No | textarea | Enter Description |
Secret Details
| Field | Required | Control | Placeholder |
|---|---|---|---|
| Credentials | Yes | large JSON textarea | a full service-account JSON skeleton (below) |
| HMAC Access key | No | text | Enter HMAC Access Key |
| HMAC Secret Key | No | text | Enter HMAC Secret Key |
The Credentials field is pre-filled with a placeholder service-account document:
{
"type": "service_account",
"project_id": "project-id",
"private_key_id": "a123b456c789d012e345f678g901h234i567j890",
"private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQ...\n-----END PRIVATE KEY-----\n",
"client_email": "my-service-account@project-id.iam.gserviceaccount.com",
"client_id": "123456789012345678901",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://oauth2.googleapis.com/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/my-service-account%40project-id.iam.gserviceaccount.com"
}
An inline note above the HMAC pair reads:
Provide HMAC keys, as Turbo currently supports only HMAC-based authentication.
Validate and Metastore
- Validate is available for this type, and stays disabled until the required field is filled.
- This type does not expose the Metastore dropdown.
