Service accounts: creating them, granting roles, attaching them to resources, and default service accounts

A service account is an identity for a workload, not a person. Applications running on VMs, GKE, Cloud Run or Cloud Run functions use service accounts to call Google APIs. A service account has an email address like app-sa@my-proj.iam.gserviceaccount.com. It is both a principal (it can be granted roles) and a resource (people can be granted roles on it, such as permission to use it).