---
updatedAt: 2025-07-17T19:38:01.000Z
agentTools:
projectIndex: https://docs.doppler.com/llms.txt
---
# GCP Service Account
Doppler supports rotating GCP Service Accounts keys. Rotating the underlying service account keys instead of the key object itself improves auditability and consistency within your infrastructure while maintaining a strong security posture.
## Requirements
* Understand the [Doppler rotation](secrets-rotation) methodology
* GCP Account with the ability to create [GCP Service Accounts](https://cloud.google.com/iam/docs/service-accounts)
## Overview
[GCP Service Accounts](https://cloud.google.com/iam/docs/service-accounts) are an account type that can be used programmatically for authentication. Specifically, Doppler supports rotating service accounts leveraging [user-managed key pairs](https://cloud.google.com/iam/docs/service-accounts#user-managed-keys). GCP supports up to ten active key pairs for a service account, though Doppler requires that no more than eight key pairs exist to guarantee that Doppler can always generate new keys.
Two service accounts are involved in the rotation process - the service account whose keys are actually rotated and a service account for Doppler to utilize (impersonate) to perform the rotation. The service account Doppler uses for account impersonation can be utilized to rotate any number of service account keys.
### Service Account Impersonation
To perform GCP Service Account key rotation, Doppler 'impersonates' a finely scoped service account that you create in your account. After impersonating the service account, the GCP APIs are used to perform key rotation.
When creating the impersonation service account, a custom, one-off slug is entered in the service account description. Doppler uses this as a second verification parameter in order to combat the [confused deputy problem](https://en.wikipedia.org/wiki/Confused_deputy_problem), as GCP does not have a native mechanism for this like AWS does.
## Configuration
### Enable the IAM API
1. [Enable the IAM API](https://console.cloud.google.com/apis/library/iam.googleapis.com) in your GCP project if it isn't already
### Optional: Add Doppler's Google Workspace ID if Domain Restricted Sharing is enabled
If [Domain Restricted Sharing](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains) is enabled on your GCP project or organization, you need to add Doppler's workspace ID to the allowed entries.
1. Navigate to the [domain restricted sharing](https://console.cloud.google.com/iam-admin/orgpolicies/iam-allowedPolicyMemberDomains) policy within GCP Organization Policies
2. Select **Manage Policy**
3. Under **Rules**, add Doppler's workspace ID `C03c9go8j` using a Custom Allow rule. Save it.
### Create the Service Account for Impersonation
1. Navigate to the Doppler config you would like to add a rotated secret to
2. Click the dropdown next to **Add Secret** and select **Add Rotated Secret**
3. Name your rotation integration
4. Make note of the impersonation slug - you will use it below
5. In a new browser tab, navigate to [Service Accounts](https://console.cloud.google.com/iam-admin/serviceaccounts) within the **IAM & Admin**
6. Select **Create Service Account**
7. Name your service account, with a good example being `DopplerImpersonationSA`
8. In the description, enter the slug displayed in the rotated secret creation workflow above; it will be in the format of `doppler_impersonate:`
9. Select **Done**
10. From the **Service Accounts** table, select the service account you just created
11. On the service account's **Details** tab, copy the service account's email address
12. Go to the **Permissions** tab
13. Select **Grant Access**
14. Paste the service account email in the **Principals** input and hit tab. You will be granting the service account access to itself.
15. Change the **Role** to `View Service Accounts`
16. Select **Save**
17. Select **Grant Access** again.
18. Under **Principals** enter `operator@doppler-integrations.iam.gserviceaccount.com` and assign it the roles `Service Account Token Creator` and `View Service Accounts`
19. Select **Save**
20. Enter the service account email in the Doppler UI and hit **Next**
### Configure the Service Account to Rotate
1. In GCP, If you do not already have a Service Account to rotate, create one and configure it accordingly
2. Navigate to its details page and then its **Permissions** tab
3. Select **Grant Access** and in the **Principal** input, enter the email for the impersonation service account created above
4. Enter `Service Account Key Admin` for the role
1. **Note**: the impersonating service account - i.e. Doppler - will only be able to modify this specific service account's keys
5. From the **Details** tab for the service account to be rotated, grab the service account email.
6. In the Doppler UI, enter the service account email in the corresponding input
7. Select the interval the key pairs should be rotated at. Hit **Next** to finish setup
Behind the scenes, Doppler created a new key pair for the service account and injected it into the Doppler config. The next key pair will be created at the interval defined during setup
## Injected Values
After creating the GCP Service Account keys rotated secret, two individual secrets will be available in the config. Doppler ensures the **[active](secrets-rotation#two-secret-strategy)** secret instance is returned when requested or synced. Each is prefixed with the name of your rotated secret.
* **KEY\_NAME** - the ID of the GCP Service Account key pair
* **KEY** - the private key for the GCP Service account key pair