How to Import an Google Service Account Key into Terraform

Import Google Service Account Key with Terraback (recommended)

Terraback reverse-engineers your live infrastructure: it reads the Google Cloud IAM resource with read-only credentials, generates the HCL, and produces the exact import block. Two commands take you from a live Google Service Account Key to managed Terraform.

terraback scan all gcp --project my-gcp-project

terraback gcp import --method bulk

The Terraform import block

Terraback emits a Terraform 1.5+ import block like the one below. Because the block lives in your configuration, the import is reviewable in a pull request and repeatable across environments.

import {
  to = google_service_account_key.deploy
  id = "projects/my-project/serviceAccounts/deploy@my-project.iam.gserviceaccount.com/keys/abc123..."
}

Example google_service_account_key configuration

Here is a realistic Google Service Account Key block. Terraback generates a fuller version from your actual resource attributes; this is a minimal, valid starting point.

resource "google_service_account_key" "deploy" {
  service_account_id = google_service_account.deploy.name
  public_key_type    = "TYPE_X509_PEM_FILE"
}

Gotchas when importing a Google Service Account Key

• The Terraform google provider does not support importing google_service_account_key: the private key is only ever returned at creation, so an existing key cannot be brought under management and must be recreated instead.
• The generated private_key is a highly sensitive value stored in plaintext in Terraform state; treat the whole state file as a secret and prefer Workload Identity over keys where possible.
• service_account_id should be the service account name or unique ID (for example google_service_account.deploy.name), and that parent service account is a separate resource.
• Recreating this resource rotates the key, immediately invalidating the previous credentials that any external systems were using.

Doing it manually with terraform import

The native approach is to write the google_service_account_key block by hand, then run terraform import google_service_account_key.example <import-id> for every resource, one at a time. That works for a handful of resources, but it does not scale: you author all the HCL yourself and repeat the command for each item. Terraback generates the HCL and the import blocks for your whole account in one pass.

Import other Google Cloud resources