agent-platform-migrate-from-ai-studio: service account key download and org policy disablement in the OpenClaw setup
Summary
The OpenClaw section of skills/cloud/agent-platform-migrate-from-ai-studio/SKILL.md instructs the agent to create a
service account key, copy the private key to a Compute Engine VM, and point GOOGLE_APPLICATION_CREDENTIALS at it. When
the organization policy that blocks key creation is enforced, the skill instructs the agent to pause and prompt the user
to turn that policy off.
The same file, 150 lines earlier, already documents the correct approach for this exact runtime. A separate skill in this repository states the opposite rule in explicit terms. The step is also unnecessary, because the VM described has an attached service account and resolves Application Default Credentials from the metadata server without a key.
A second, unrelated defect in the same section is covered at the end: the command that reads the project number reads the project ID instead.
1. The skill contradicts its own guidance
SKILL.md lines 111 to 124, under Service Auth:
When running your application on Google Cloud infrastructure such as a Compute Engine VM, authenticate using the machine's attached Service Account.
gcloud projects add-iam-policy-binding "{project_id}" \
--member="serviceAccount:[email protected]" \
--role="roles/aiplatform.user"
The OpenClaw section then relies on that section. SKILL.md line 252:
Ensure that the runtime where OpenClaw is running (e.g. GCE VM with Service Account) has the
aiplatform.userIAM role
- see Authentication and Authorization section above.
Having established an attached service account with the required role, the next step creates a long-lived private key for
that same identity and moves it over the network. SKILL.md lines 271 to 278:
mkdir -p ~/.config/gcloud
gcloud iam service-accounts keys create ~/.config/gcloud/application_default_credentials.json \
--iam-account="${PROJECT_NUMBER}[email protected]"
From outside the GCE instance, generate
GOOGLE_APPLICATION_CREDENTIALSusing the Google Cloud project number. Then,scpthese credentials to the GCE VM.
On a VM with an attached service account, Application Default Credentials are served by the metadata server. No key is required for the credential to resolve.
2. Another skill in this repository states the opposite rule
skills/cloud/google-cloud-storage-basics/references/mcp-usage.md lines 147 to 156:
The Toolbox uses Application Default Credentials (ADC) in every environment: locally via the command below, on GCP compute via the attached service account, and elsewhere (CI, on-prem) via workload identity federation. Never download a service-account key file or set
GOOGLE_APPLICATION_CREDENTIALSto one — key files are a security liability and are never needed for the Toolbox.
Two skills in the same repository give a reader opposite instructions for the same decision.
3. The target path collides with the file gcloud manages
The key is written to ~/.config/gcloud/application_default_credentials.json. That is the well-known ADC path written by
gcloud auth application-default login. Placing a downloaded service account key there overwrites whatever user
credential is present and makes the substitution invisible to anything that later reads ADC from the default location.
The identity involved is the Compute Engine default service account, which is the identity every VM in the project runs as unless configured otherwise. A downloaded key for it is a long-lived, portable credential for that identity, valid until it is explicitly deleted.
4. The skill instructs the agent to have a security control turned off
SKILL.md lines 280 to 285:
Troubleshooting Policy Constraints on New Orgs: New Google Cloud organizations (created on or after May 4th, 2024) enforce a legacy Organization Policy, restricting Service Account Key Creation. To complete this step, this Org Policy must be temporarily disabled. An Organization Policy Admin must set this policy to Inactive. To the agent: Check if this policy is enforced, and if it is: pause, and prompt the user to disable it at this Console link: https://console.cloud.google.com/iam-admin/orgpolicies
constraints/iam.disableServiceAccountKeyCreation is part of the secure-by-default set applied to organizations created
on or after May 3, 2024. It is enforced specifically to prevent the action this step requires.
Two points on the framing:
The policy is described as "legacy". The constraint is a current secure-by-default control, not a deprecated one.
The date given is May 4th, 2024. The documented date is May 3, 2024.
Instructing an autonomous agent to prompt an administrator to disable an organization-wide security control, in order to complete a step that the attached service account already satisfies, is worth reconsidering independently of the wording.
5. Separate defect: the project number command reads the project ID
SKILL.md lines 264 to 269:
export PROJECT_NUMBER=$(curl "http://metadata.google.internal/computeMetadata/v1/project/project-id" -H "Metadata-Flavor: Google")
echo "Project number: $PROJECT_NUMBER"
project/project-id returns the project ID. The project number is served by project/numeric-project-id.
The value is then interpolated into a service account address that requires the number:
${PROJECT_NUMBER}[email protected]
With the project ID substituted, that address does not resolve to the Compute Engine default service account, so the
in-VM path of this step fails as written. The out-of-VM branch immediately above it is correct, since it uses
--format="value(projectNumber)".
Suggested correction:
export PROJECT_NUMBER=$(curl "http://metadata.google.internal/computeMetadata/v1/project/numeric-project-id" -H "Metadata-Flavor: Google")
Suggested change
For the OpenClaw section, on a VM that already has the attached service account established earlier in the skill:
Remove the
gcloud iam service-accounts keys createstep and the instruction toscpthe key to the VM.Remove
GOOGLE_APPLICATION_CREDENTIALSfrom theopenclaw.jsonexample at line 304.GOOGLE_CLOUD_PROJECTandGOOGLE_CLOUD_LOCATIONare sufficient when ADC resolves from the metadata server.Remove the organization policy note, which exists only to support the removed step.
For a workstation outside Google Cloud, direct the reader to
gcloud auth application-default login, matching Option 2 - Manual Setup at line 96 of the same file.For a non-Google-Cloud host that needs a workload identity, direct the reader to workload identity federation, matching the guidance already given in
google-cloud-storage-basics/references/mcp-usage.md.
A minor observation on the same block, offered without a strong claim: the value at line 304 is the literal string
~/.config/gcloud/application_default_credentials.json. Tilde expansion is performed by the shell, not by the consumer
of an environment variable read from a JSON file, so this path may not resolve even where the intended approach is kept.
References
Compute Engine, view and query VM metadata: https://docs.cloud.google.com/compute/docs/metadata/querying-metadata
Managing secure-by-default organization resources: https://docs.cloud.google.com/resource-manager/docs/secure-by-default-organizations
Compute Engine default service account: https://docs.cloud.google.com/compute/docs/access/service-accounts#default_service_account
Environment
Observed at commit 8f57a0d, on main.
Source: google/skills