Step 5: Create service accounts and credentials

This step explains how to create the Google Cloud service accounts and TLS credentials that are required for Apigee hybrid to operate.

Create the service accounts

Apigee hybrid uses Google Cloud service accounts to allow hybrid components to communicate by making authorized API calls.

In this step, you use an Apigee hybrid command-line tool to create a set of service accounts and download the service account private key files.

Apigee provides a tool, create-service-account, that creates the service accounts, assigns the roles to the service accounts, and creates and downloads the key files for the service account in a single command. To learn about the related Google Cloud concepts, see Creating and managing service accounts and Creating and managing service account keys.

Be sure that you are in the base_directory/hybrid-files directory you configured in Set up the project directory structure.
Execute the following command from inside the hybrid-files directory. This command creates a single service account named apigee-non-prod for use in a non-production environments and places the downloaded key file in the ./service-accounts directory.
```
./tools/create-service-account --env non-prod --dir ./service-accounts --project-id PROJECT_ID
```
Where PROJECT_ID is the Project ID of the Google Cloud project in which you are creating the service accounts. See also create-service-account syntax.
Note: If you would prefer to create all the individual service accounts for a production environment, use the following command:
```
./tools/create-service-account --env prod --dir ./service-accounts
```
When you see the following prompt, enter y:
```
[INFO]: gcloud configured project ID is project_id.
 Enter: y to proceed with creating service account in project: project_id
 Enter: n to abort.
```
If this is the first time an SA with the same name assigned by the tool was created, then the tool just creates it, and you do not have to do anything further.

If, however, you see the following message and prompt, enter y to generate new keys:
```
[INFO]: Service account apigee-non-prod@project_id.iam.gserviceaccount.com already exists.
...
 [INFO]: The service account might have keys associated with it. It is recommended to use existing keys.
 Press: y to generate new keys.(this does not de-activate existing keys)
 Press: n to skip generating new keys.
```
Note: The Cloud Pub/Sub API must be enabled in the Google Cloud project that owns the service account for Synchronizer. See Enable APIs.
Verify that the service account key was created using the following command. You are responsible for storing these private keys securely. The key filenames are prefixed with the name of your Google Cloud project.
```
ls ./service-accounts
```
The result should look something like the following:
```
project_id-apigee-non-prod.json
```

You now have created service accounts and assigned the roles needed by the Apigee hybrid components. Next, the TLS certificates required by the hybrid ingress gateway..

1 2 3 4 5 (NEXT) Step 6: Create TLS certificates 7 8 9