Hierarchical Support for Service Accounts

Steps to configure and use account-level service accounts at project level.

FEATURE AVAILABILITY

This feature is behind the PL_ENABLE_SERVICE_ACCOUNT_HIERARCHY feature flag. Contact Harness Support to enable it.

Service accounts can be created at a higher scope and inherited by lower scopes with the necessary permissions, eliminating the need to create separate accounts for each organization or project.

The following example shows how to use an account-level service account in a project. You can apply the same process to use account-level service accounts in organizations.

Before you begin

Before you inherit an account-level service account in a project, ensure you have the following:

• Feature flag enabled: The PL_ENABLE_SERVICE_ACCOUNT_HIERARCHY feature flag, described above.

• Account-level service account: An existing service account created at the account scope.

• Project-level permissions: A role with permission to manage service accounts, roles, and resource groups at the project scope.

Interactive

Manual

Step 1: Create account-level service account

Create a Service Account at the account level. This service account can then be inherited by organizations or projects.

Step 2: Create project-level role and resource group

In your target project:

• Create a Role with the required permissions

• Create a Resource Group defining what resources can be accessed

Roles and resource groups can only be modified at the scope where they were originally assigned. Inherited roles and resource groups are visible at lower scopes but cannot be edited there.

Step 3: Inherit and assign permissions

To inherit the account-level service account and assign it permissions, do the following:

1. Navigate to Project Settings → Access Control → Service Accounts

2. Select Inherit Service Account & Assign Roles

3. Choose your account-level service account

4. Assign the project-level role and resource group

5. Select Apply

The service account is now available for this project.

When a service account is inherited from the account scope to a project scope, the system automatically assigns the Organization Viewer role to that service account for the organization containing the project. The role assignment is also recorded in the Audit Logs.

If this role assignment is removed, the service account may lose access to the Organization.

Benefits

Hierarchical support for service accounts provides the following benefits:

• Centralized Service Account Management: Reduces the need to create and manage multiple service accounts for each project.

• Simplified Permissions: Easily manage permissions at the project level by assigning roles to service accounts created at the account or organization level.

• Seamless Pipeline Execution: One or more service accounts can be given the necessary permissions, if required, to execute pipelines from multiple projects.

Additional resources

For more information on how to manage service accounts, create roles, and assign permissions in Harness, go to the following documentation on Harness Developer Hub:

• Managing Service Accounts

• Creating and Managing Roles

• Assigning Roles and Permissions