google_service_account cost estimation

A google_service_account is a non-human identity that VMs, GKE workloads, Cloud Run services, and CI pipelines use to authenticate to Google Cloud APIs. Creating a service account is free, and so is attaching it to a resource or minting short-lived tokens for it. There is no per-account charge and no usage meter on the identity itself.

Unlike networking or load-balancing pieces, a service account does not sit in front of a paid resource, so it has no direct cost driver. Its cost relevance is entirely indirect: the account is granted IAM roles (via google_project_iam_member and similar bindings, which are also free) that let workloads call APIs and operate paid resources. A service account with broad permissions can enable expensive actions, but that is a security and governance concern, not a billing one.

The one adjacent thing to keep clean is service account keys. Exported JSON keys are free but a security liability; Workload Identity Federation and attached service accounts avoid long-lived keys entirely at no cost. c3x treats the service account, its IAM bindings, and its short-lived tokens as free, and prices the resources a workload running as that account actually provisions.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "google_service_account" "app" {
  account_id   = "app-runtime"
  display_name = "Application runtime service account"
}

Pricing dimensions

What you actually pay for when you provision google_service_account.

Dimension	Unit	What's being charged
Service account	free	The identity, its attachment to resources, and short-lived token minting have no charge. $0
IAM bindings	free	Roles granted to the account via IAM bindings are free. They enable, but do not bill for, access. $0
Resources the workload provisions	varies	Paid resources a workload running as the account creates or operates carry their own cost.

Optimization tips

Common ways to reduce google_service_account cost without changing the workload.

Use one service account per workload

Per-workload accounts are free and make it clear which identity drives which paid resources, so cost and blast radius are attributable. Sharing one account across services muddies both.

Avoid exported keys with Workload Identity

Workload Identity Federation and attached service accounts remove long-lived JSON keys at no cost, cutting a security liability without adding a line item.

Grant least privilege

Scoping roles tightly does not change the free account, but it limits which expensive actions a compromised or misconfigured workload could take.

FAQ

Does a service account cost money?

No. Service accounts, their IAM role bindings, and short-lived token minting are all free. There is no per-account charge. Cost comes only from the paid resources a workload operates.

Are service account keys billed?

No. Exported JSON keys are free but a security risk. Prefer Workload Identity Federation or attached service accounts, which are also free and avoid long-lived credentials.

How does a service account relate to my bill?

Indirectly. The account is the identity a workload uses to create and operate paid resources. c3x prices those resources and treats the service account and its bindings as free.