> [!CAUTION]
> You are currently viewing version 1.9 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](https://docs.cloud.google.com/apigee/docs/hybrid/supported-platforms#supported-versions).

<button class="button button-with-icon cloud-select-dropdown__button button-primary" aria-haspopup="true">Version 1.9 (unsupported)</button>

- Supported versions:
- [v1.17 (latest)](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/sa-validation.html)
- [v1.16](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/sa-validation.html)
- [v1.15](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/sa-validation.html)
- [v1.14](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/sa-validation.html)
- [List of supported versions](https://docs.cloud.google.com/apigee/docs/hybrid/supported-platforms#supported-versions)
- Unsupported versions:
- [v1.13](https://docs.cloud.google.com/apigee/docs/hybrid/v1.13/sa-validation.html)
- [v1.12](https://docs.cloud.google.com/apigee/docs/hybrid/v1.12/sa-validation.html)
- [v1.11](https://docs.cloud.google.com/apigee/docs/hybrid/v1.11/sa-validation.html)
- [v1.10](https://docs.cloud.google.com/apigee/docs/hybrid/v1.10/sa-validation.html)
- [v1.9](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/sa-validation.html)
- [v1.8](https://docs.cloud.google.com/apigee/docs/hybrid/v1.8/sa-validation.html)
- [v1.7](https://docs.cloud.google.com/apigee/docs/hybrid/v1.7/sa-validation.html)
- [v1.6](https://docs.cloud.google.com/apigee/docs/hybrid/v1.6/sa-validation.html)
- [v1.5](https://docs.cloud.google.com/apigee/docs/hybrid/v1.5/sa-validation.html)
- [v1.4](https://docs.cloud.google.com/apigee/docs/hybrid/v1.4/sa-validation.html)
- [v1.3](https://docs.cloud.google.com/apigee/docs/hybrid/v1.3/sa-validation.html)
- [v1.2](https://docs.cloud.google.com/apigee/docs/hybrid/v1.2/sa-validation.html)
- [v1.1](https://docs.cloud.google.com/apigee/docs/hybrid/v1.1/sa-validation.html)

Apigee hybrid provides validation that ensures the location of your service accounts' keys
are correct and that the accounts have the proper permissions in your GCP project. This validation
is enabled by default.

This section describes how to enable or disable service account validation. In addition, this
step ensures that you have the proper APIs enabled for your GCP project so that validation
works.

## Enable service account permission validation

**To enable permission validation:**

1. Be sure the [Cloud Resource Manager API](https://cloud.google.com/resource-manager/reference/rest/) is enabled for your GCP project:
   1. Open the [Google Cloud console](https://console.cloud.google.com) and log in with the account you created in [Step 1: Create a Google Cloud account](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/precog-gcpaccount).
   2. Select the project that you created in [Step 2: Create a Google Cloud project](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/precog-gcpproject).
   3. Select **APIs \& Services \> Library**.
   4. Search for "Cloud Resource Manager".
   5. Locate the **Cloud Resource Manager API** service and click on it.
   6. If it is not enabled, click **Enable**.

   You can also enable the API using gcloud:

   ```
   gcloud services enable cloudresourcemanager.googleapis.com --project GCP_project_ID
   ```
2. In your overrides file, add the `validateServiceAccounts` property and set it to `true`. For example:

   ```
   ...
   # Enables strict validation of service account permissions.
   validateServiceAccounts: true
   ...
   ```

When validation is enabled, any time [apigeectl](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/cli-reference) applies the
Apigee hybrid runtime components to your cluster, it validates the
[service account](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/precog-serviceaccounts) keys that are included in your overrides
file.

> [!NOTE]
> **NOTE:** Service account JSON key format validation is always performed. You do not have to take any steps to enable this validation and you cannot disable it.

## Troubleshooting validation errors

> [!WARNING]
> **Deleting and recreating service accounts:** Note that reusing the name of a deleted service account may result in unexpected behavior. If you create a service account and delete it, always recreate it with a different name than the original SA. For details, see [Deleting and recreating service accounts](https://cloud.google.com/iam/docs/service-account-overview#deleting-recreating).

If validation fails, the runtime deployment stops and `apigeectl` exits.
To troubleshoot service account failure, it's helpful to know that validation checks
permissions in this order:

1. Permission on the project ID.
2. (For UDCA and Synchronizer only) If the permission check on the project fails, validation proceeds to check permission against the Apigee environment's [IAM policy](https://docs.cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.environments/setIamPolicy). These SAs are environment scoped and environments support finer-grained permissions.


   To update the IAM policy for a specific environment, go to the hybrid UI. Go to
   **Admin \> Environments \> Access**


For example, the following is an error message for a failed permission check:

```
Invalid Metrics Service Account. Service Account
"apigee-metrics@hybrid-project.iam.gserviceaccount.com" is missing 1 or more required
permissions [monitoring.metricDescriptors.create monitoring.metricDescriptors.get monitoring.metricDescriptors.list
monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.create].
Visit Service accounts and roles used by
hybrid components for more details on setting up Apigee hybrid service account permissions.
```


To address this error, add the required roles to the service account. For
information on creating and modifying service accounts, see [Create the service accounts](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/sa-about#create-the-service-accounts). To check the required permissions for each Apigee hybrid component, see
[Service accounts and roles used by hybrid components](https://docs.cloud.google.com/apigee/docs/hybrid/v1.9/sa-about#recommended-sas).

## Disable permission validation

To disable service account permission validation, set the `validationServiceAccounts`
property in your overrides file to `false`, as the following example shows:

```
...
# Enables strict validation of service account permissions.
validateServiceAccounts: false
...
```