Google cloud How to list all service-accounts from all Projects in GCP

Question

I need to obtain every property of a service account in the Google Cloud. Is it feasible to list every property using a selector like *?

Otherwise, I need to know the following:

Name of the SA account Email address
I have a role.
User controlled Account creation date, last use date, and time of authentication. Keys (if any).
Account status (enabled or disabled): Project name
I am able to obtain all of the projects and service accounts within it, but I am unsure of how to obtain the additional values.

foreach ($project in gcloud projects list --format="value(projectId)")
{
  Write-Host "ProjectId: $project"
  foreach ($robot in  gcloud iam service-accounts list --project $project --format="value(email)")
  {
     Write-Host "    -> Robot $robot"
   
  }
}

Answer 1

It's been noted by the commenters that this isn't a minor issue.

However, I'm always game for some gcloud criticism;-)

Your code sample indicates that you want the response in PowerShell, which I don't have. I hope you don't mind if I provide you with some incomplete pointers in bash instead.

Does:

Project ID Account name Email Keys Creation (timestamp) Enabled|Disabled Doesn't:

role definitions
Audit logs, last used?

PROJECTS=$(gcloud projects list --format="value(projectId)")

for PROJECT in ${PROJECTS}
do
  echo "Project: ${PROJECT}"
  # Extracts ACCOUNT_ID, EMAIL (==ACCOUNT_ID@...), DISABLED
  ROBOTS=$(\
    gcloud iam service-accounts list \
    --project=${PROJECT} \
    --format="csv[no-heading](displayName.encode(\"base64\"),email,email.split(\"@\").slice(0),disabled)")
  for ROBOT in ${ROBOTS}
  do
    # Parse results
    IFS=, read ENCODED_NAME EMAIL ACCOUNT_ID DISABLED <<< ${ROBOT}
    NAME=$(echo -e ${ENCODED_NAME} | base64 --decode)
    echo "  Service Account: ${NAME}"
    echo "    Disabled: ${DISABLED}"
    echo "    Email: ${EMAIL}"
    # Keys
    KEYS=$(\
        gcloud iam service-accounts keys list \
        --iam-account=${EMAIL} \
        --project=${PROJECT} \
        --format="value(name.scope(keys))")
    for KEY in ${KEYS}
    do
      echo "    Key: ${KEY}"
    done
    # Creation (Only searches back 30-days!)
    FILTER=""\
"logName=\"projects/${PROJECT}/logs/cloudaudit.googleapis.com%2Factivity\" "\
"resource.type=\"service_account\" "\
"protoPayload.methodName=\"google.iam.admin.v1.CreateServiceAccount\" "\
"protoPayload.request.account_id=\"${ACCOUNT_ID}\" "

    LOG=$(\
        gcloud logging read "${FILTER}" \
        --project=${PROJECT} \
        --format=json \
        --freshness=30d \
        --format="value(timestamp)")
    echo "    Created: ${LOG}"
  done
done

I hope this helps!

Enroll for our Google Cloud training and learn more about Google Cloud accounts.

Thanks!