Create and manage service accounts

A service account is not an actual IAM user account.
It is used to access or control project resources, and can replace an IAM user when issuing API authentication tokens within a project.

Management permissions by function

Service accounts can be viewed and managed from either the IAM menu or the Project Management menu.
However, available functions depend on the user’s assigned roles, and some operations are only available in specific menus.
Check the required permissions before performing each task.

Function	IAM menu (Organization-level roles)	Project Management menu (Project-level roles)
View service account	Organization Admin, IAM Organization Admin, IAM Organization Viewer	Project Admin, Project Leader, IAM Project Admin, IAM Project Viewer
Create / edit / delete service account	❌ Not supported	Project Admin, IAM Project Admin
Create / delete credential (IAM / S3 access keys)	❌ Not supported	Project Admin, IAM Project Admin
View credential	Organization Admin, IAM Organization Admin, IAM Organization Viewer	Project Admin, IAM Project Admin, IAM Project Viewer
View service agent	Organization Admin, IAM Organization Admin, IAM Organization Viewer	Project Admin, IAM Project Admin, IAM Project Viewer

View service account

Service accounts are created and managed per project, and can be viewed from either the IAM or Project Management menus.

1. Log in to the Kakao Cloud Console.

2. Go to the appropriate menu based on your role:

   • With organization-level roles → Management > IAM > Projects, select a project, then open the Service Accounts tab.
   • With only project-level roles → Console Dashboard > Project Management > Service Accounts.

3. The list of service accounts in the project is displayed in a table. You can view details for each entry.

   Field	Description
   ID	Service account ID – Format: {custom-input}-{project-unique-id}@kc.serviceaccount.com
   Name	User-defined service account name
   Status	Service account state – 🟢 Active: Available for use – ⚪️ Inactive: Temporarily disabled
   Created at	Creation time of the service account

Create a service account

Service accounts allow project members to access or control Kakao Cloud resources via API authentication tokens.
They can be created from the Project Management menu.

info

• Each project can have up to 100 service accounts, including inactive ones.
• Service accounts cannot belong to groups. Unlike IAM user accounts, service accounts are created individually, and IAM roles must be assigned directly to each service account.

1. In the Kakao Cloud Console, go to Dashboard > Select project to open the desired project.

2. In the selected project, click Go to Project Management.

3. Open the Service Accounts menu and click Create service account.

4. In the Create service account dialog, enter the required information and click Create.

   Service account creation

   Field	Description
   Project	Name of the associated project (auto-filled).
   Service account ID	Automatically generated unique email-formatted ID. Example: {custom-input}-{project-unique-id}@kc.serviceaccount.com
   Service account name	Display name of the service account (up to 30 characters).
   Project role	IAM role to assign to this service account.

Change service account state

You can enable or disable a service account depending on its usage.
Setting an account to inactive improves security by blocking access when it is temporarily unused.

caution

When a service account is set to inactive, all its access keys and API tokens are immediately revoked.
Review potential resource access impacts before changing the status.

1. In the Kakao Cloud Console, go to Dashboard > Select project.
2. Click Go to Project Management.
3. In the Service Accounts menu, click the More icon next to the target account and select Settings.
4. In the dialog, toggle the state between Active / Inactive, then click Save.

Delete service account

Unused service accounts can be deleted.
Once deleted, the account cannot be recovered, and all issued access keys and API tokens become invalid.

caution

Deleting a service account immediately invalidates all its access keys and API tokens.
Confirm the impact on connected resources before proceeding.

1. In the Kakao Cloud Console, go to Dashboard > Select project.
2. Click Go to Project Management.
3. In the Service Accounts menu, select the account(s) to delete and click Delete.
4. In the confirmation dialog, type Delete service account and click Delete.

Issue credentials for service account

To call APIs using a service account, you must generate credentials — either an IAM access key or an S3 access key.
These credentials serve as authentication tokens and can be viewed and copied directly from the console.

1. In the Kakao Cloud Console, select the target project.

2. Click Go to Project Management.

3. In the Service Accounts menu, select the service account for which to issue a key.

4. In the Credentials tab, choose one of the following key types:

   • IAM access key: Used for Kakao Cloud OpenAPI authentication.
   • S3 access key: Used for Object Storage S3 API authentication.

5. Click Create access key and enter the required details.

   Field	Description
   Project	Name of the associated project (auto-filled).
   Service account ID	{custom-input}-{project-unique-id}@kc.serviceaccount.com (auto-filled).
   Access key name	Identifier name for the key.
   Access key description	Optional, up to 30 characters.

6. The Access Key ID and Secret Access Key are displayed.
   Click Copy to save them securely — the Secret Access Key is shown only once at creation.

7. Click Confirm to complete the process.

info

• Each service account can have up to two IAM access keys and two S3 access keys.
• Service account access keys can only be used to issue API tokens. They cannot be used to create or delete keys, or to delete service accounts.

Delete service account credentials

If an IAM or S3 access key is no longer needed, it can be deleted directly from the console.
Deleted keys can no longer authenticate API calls — verify any dependent systems before deletion.

caution

Deleted keys cannot be recovered, and any API tokens issued with those keys become invalid immediately.

1. In the Kakao Cloud Console, go to Dashboard > Select project.
2. Click Go to Project Management.
3. In the Service Accounts menu, select the service account and open its Credentials tab.
4. Choose the IAM access key or S3 access key to delete and click Delete.
5. In the confirmation dialog, type Delete IAM access key or Delete S3 access key, then click Delete.

View service agent

A service agent is an account used internally by Kakao Cloud services to access resources or execute automated operations on behalf of the user.
These accounts are created automatically when certain services are used and cannot be modified or deleted manually.

Service agents can be viewed from either the IAM or Project Management menus.

1. Log in to the Kakao Cloud Console.

2. Go to the appropriate menu based on your role:

   • With organization-level roles (Organization Admin or IAM Organization Admin): Management > IAM, then select a project.
   • With only project-level roles (Project Admin or Member): Console Dashboard > Project Management.

3. Select the project, then open the Service Agents tab.

4. The service agents created within the project are listed in a table with detailed information.

   Field	Description
   Service	Name of the service that generated the agent.
   ID	Service agent ID – Format: {project-unique-id}@{service-name}.kc.serviceaccount.com
   Status	Agent status – 🟢 Active: Normal state – ⚪️ Inactive: Restricted state
   Created at	Timestamp when the agent was automatically created.