About service accounts
Reviewed on · View on GitHub
- Create a service account
- List service accounts
- Get the details of a service account
- Update a service account
- Delete a service account
- List the spaces assigned to a service account
- Create an access key
- List access keys
- Get access key details
- Delete an access key
A service account is a non-human account used to automate tasks or carry out operations on behalf of a user. It authenticates against the Numspot API (Application Programming Interface) to manage the resources of the spaces it is attached to, within the limits of the IAM (Identity and Access Management) permissions granted to it.
General information
A service account is characterized by:
- a name, chosen at creation;
- an access key, generated by Numspot;
- a secret code, generated by Numspot at creation and used for authentication;
- an optional expiration date;
- one or more spaces it has access to;
- IAM roles that determine its permissions.
Authentication
When a service account is created, Numspot returns its access key and its secret code. The secret code is never displayed again afterwards — you must keep it in a secure location from the moment of creation.
The access key and the secret code are used together to authenticate the account against the API.
Access keys (AK/SK)
In addition to the secret code generated at creation, a service account can hold up to two durable AK/SK credentials (an access key and its secret key). They authenticate access to the Object Storage, with a signature compatible with the AWS tooling, without exchanging a token at each session.
- the access key identifies the credential;
- the secret key is displayed only once, at creation;
- each credential has a configurable lifetime, from 1 hour to 1 year (1 year by default), and a status (
ACTIVE,INACTIVEorEXPIRED); - deleting a credential immediately revokes the sessions opened with it.
To manage these credentials, see the dedicated actions: create, list, details and delete. For a temporary credential obtained from a token, see the Object Storage quickstart.
Spaces and permissions
A service account can be attached to several spaces. Its permissions are defined by the IAM roles assigned to them. You can view the list of spaces assigned to a service account at any time.