gcp.iam.service_account_key.create

Mint a JSON key for a GCP service account

Mints a JSON key for a GCP service account (iam.serviceAccounts.keys.create). Returns the private-key material — the value used as a Cloudflare Pages GCP_SA_KEY secret to invoke a private Cloud Run backend. The key is SENSITIVE: it is returned only on the success surface and is never logged.

Inputs:

• connection_uuid: Cloud connection UUID (required)
• account_email: Full SA email owning the key (required)
• project_id: Explicit project_id (optional; defaults to connection)
• key_algorithm: KEY_ALG_RSA_2048 (default) or KEY_ALG_RSA_1024 (optional)
• private_key_type: TYPE_GOOGLE_CREDENTIALS_FILE (default; JSON) or TYPE_PKCS12_FILE (optional)

Outputs:

• private_key_data: SENSITIVE. The JSON key file contents.
• key_name: Full key resource name (.../keys/{id}) — needed to delete.
• key_id: Key id.
• account_email
• project_id

Overview

Property	Value
Workflow type	Atomic
Library	Base-gcp
Version	1.0

Input Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	Yes	—	—
account_email	string	Yes	—	—
project_id	string	No	—	—
key_algorithm	string	No	—	KEY_ALG_RSA_2048 (default) or KEY_ALG_RSA_1024.
private_key_type	string	No	—	TYPE_GOOGLE_CREDENTIALS_FILE (default; JSON) or TYPE_PKCS12_FILE.

Output Schema

Field	Type	Required	Default	Description
private_key_data	string	No	—	SENSITIVE. The JSON key file contents; never persist or log.
key_name	string	No	—	Full key resource name (.../keys/{id}) — needed to delete/rotate.
key_id	string	No	—	—
account_email	string	No	—	—
project_id	string	No	—	—
connection_uuid	uuid	No	—	—
key_algorithm	string	No	—	—
private_key_type	string	No	—	—
failure_reason	string	No	—	—
failure_type	string	No	—	—
failed_action	string	No	—	—
failed_at_state	string	No	—	—
failed_step	string	No	—	—
failed_layer	string	No	—	—
error	string	No	—	—
error_type	string	No	—	—

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	execute	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	execute	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "gcp.iam.service_account_key.create",
  "initial_data": {
    "connection_uuid": "value",
    "account_email": "value"
  }
}