For AI agents: the complete documentation index is available at https://docs.dataplatform.ovh.net/llms.txt, the full documentation bundle is available at https://docs.dataplatform.ovh.net/llms-full.txt, and this page is available as Markdown at https://docs.dataplatform.ovh.net/iam-service-accounts.md.
  • 🇬🇧 English

    • Create service accounts for API and automated access

    A service account is a special kind of account used by API consumers, remote server access, scripts, or other automated entities

    Objective

    A service account is a special kind of account used by API consumers, remote server access, scripts, or other automated entities, rather than by a physical person.

    On Data Platform, service accounts are generally used for two reasons:

    • Externally, to authenticate a remote entity that needs to access the Project through API and secret keys
    • Internally, to authenticate Project jobs. For example, a service account can be attached to a Data Processing Engine workflow, so that when executed, the job can authenticate as the service account. The service account's roles control which resources the job can access.

    They will be found in the Service Accounts tab of the Identity Access Manager. On Data Platform, each service account is identified by their technical name which must be unique to them.

    Info

    Note that Service Accounts exist ONLY in the Project IAM.

    Manage your Project service accounts

    A service account can be granted Project IAM roles that let any associated entity (whether external entities or internal jobs) access resources. The service account is used as the identity of the associated entity, and the service account's roles control which resources the entity can access.

    Info

    This makes service accounts fit to restrict the access level of a CRON-triggered Data Processing Engine job or a remote API that needs to access data on Data Platform, for example.

    There are two types of service accounts:

    • Default Data Platform-originated service accounts: they are generated at the creation of the Project so that basic services can run immediately, like the Default Project Service Account
    • User-managed service accounts: they are created by Data Platform users

    Default service account

    The Default Project Service Account is a Data Platform-originated service account that is generated automatically at the creation of the Project. It is used by default by all jobs in the Data Processing Engine for authentication and access control. This service account cannot be deleted.

    Any user from a Project can always impersonate this service account in the Data Processing Engine.

    Warning

    It is impossible to restrict the impersonation of this service account by users that are authenticated in the Project's IAM. If you want to avoid a possible privilege escalation, you need to lower the role permissions given to this default service account.

    By default, at the creation of the Project, the Default Project Service Account has Admin access in the Project.

    Create a new service account

    To add a service account in your Project, click on New service account.

    iam

    Enter a name and an email address for the service account.

    Warning

    The email address will be used to send over the API and secret keys necessary for the authentication of the remote entity.

    iam
    Info

    By default, new service accounts don't have any access right. You will need to either place them in groups or assign them roles directly.

    Add service accounts to a group Assign a role to a service account

    Use a service account internally for jobs

    All jobs in Data Processing Engine use service accounts for authentication and access control of the workload. As such, any user able to execute this job is essentially able to impersonate the service account (and get its access) through the executed workload.

    Info

    The service account of a job currently cannot be changed. This feature is coming soon!

    By default, jobs are configured to use the Default Project Service Account. It is impossible to restrict impersonation of this service account by users, so to avoid a possible privilege escalation (in the case some of your users should not be able to access everything) you should make sure to remove unnecessary permissions on this service account.

    To do so, open the Default Project Service Account page, remove all groups and roles bound to this service account, add the basic roles/groups needed for the service account, and save. The base permissions for a Data Processing Engine job to be able to run without errors are the following:

    • Data Manager | * | Read
    • Data Processing Engine | * | Read
      • Data Processing Engine | * | Write is optional and needed only if the update of metadata (such as number of rows in table) is wanted at the end of the job execution
    • Data Store | Bucket | Read, with a condition on bucket dpe

    Use a service account externally

    Whenever you need to trigger specific jobs (such as launching workflows) from outside of Data Platform, you will need to generate an API and a secret key to authenticate.

    Generate API & secret keys for service accounts

    Go further

    If you need training or technical assistance to implement our solutions, contact your sales representative or click on this link to get a quote and ask our Professional Services experts for a custom analysis of your project.

    Ask questions, give your feedback and interact directly with the team building the Data Platform on the dedicated Discord channel.

    If you need support with your OVHcloud services, create a request in our Help Centre.

    Join our community of users.