How can I see the service account that the python bigquery client uses?

Question

To create a default bigquery client I use:

from google.cloud import bigquery
client = bigquery.Client()

This uses the (default) credentials available in the environment.

But how I see then which (default) service account is used?

Answer 1

This led me in the right direction:
Google BigQuery Python Client using the wrong credentials

To see the service-account used you can do:

client._credentials.service_account_email

However:
This statement above works when you run it on a jupyter notebook (in Vertex AI), but when you run it in a cloud function with print(client._credentials.service_account_email) then it just logs 'default' to Cloud Logging. But the default service account for a Cloud Function should be: <project_id>@appspot.gserviceaccount.com.

This will also give you the wrong answer:

client.get_service_account_email()

The call to client.get_service_account_email() does not return the credential's service account email address. Instead, it returns the BigQuery service account email address used for KMS encryption/decryption.

Answer 2

While you can interrogate the credentials directly (be it json keys, metadata server, etc), I have occasionally found it valuable to simply query bigquery using the SESSION_USER() function.

Something quick like this should suffice:

client = bigquery.Client()
query_job = client.query("SELECT SESSION_USER() as whoami")
results = query_job.result()
for row in results:
    print("i am {}".format(row.whoami))

Answer 3

Following John Hanley's comment (when running on a Compute Engine) you can query the metadata service to get the email user name:
https://cloud.google.com/compute/docs/metadata/default-metadata-values

So you can either use linux:

curl "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email" -H "Metadata-Flavor: Google"

Or python:

import requests

headers = {'Metadata-Flavor': 'Google'}
response = requests.get(
    "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email", 
    headers=headers
)
print(response.text)

The default in the url used is the alias of the actual service account used.