Find integrations that need a run-as service account

This page helps you find the integrations that require a run-as service account before the authorization changes take effect.

Determine if an integration needs a run-as service account

You only need a run-as service account when user credentials are not available for the whole run. This occurs in the following situations:

Execution type User credentials available? Run-as service account required?
Synchronous — A user triggers the integration and waits for the result. Yes, for the entire execution. No
Asynchronous — The integration is queued and completes later. Yes, but only when triggered. Yes
Unattended — A schedule or an event triggers the integration. No, a user is never present. Yes

Identify affected integrations

An integration runs without a user identity if any of the following conditions are met:

Check the run-as service account status

To list all published versions in a region alongside their run-as service accounts, run the following command:

curl -s -G -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  --data-urlencode "filter=state=ACTIVE" \
  --data-urlencode "pageSize=1000" \
  "https://REGION-integrations.googleapis.com/v1/projects/PROJECT_ID/locations/REGION/integrations/-/versions" \
| jq -r '.integrationVersions[]
         | [ .name, (.runAsServiceAccount // "NONE") ]
         | @tsv'

Replace the following:

  • REGION: the region of your integration. For the list of supported regions, see Locations.
  • PROJECT_ID: the ID of your Google Cloud project

If the output shows NONE for an integration, you only need to take action if the integration meets any of the conditions listed previously.

To check an integration manually, open it in the integration editor and click Integration settings in the editor toolbar. The Service account field displays the run-as service account. It is empty if a service account is not assigned.

What's next