@@ -13,14 +13,14 @@ your application.
1313
1414## Plans
1515
16- | Plan Name | Description | Cloud Foundry Role | | ---------------- |
17- ------------------------------------------------------------------------------------------------------- |
18- ------------------ | | ` space-deployer ` | A service account for continuous deployment, initially limited to a single
19- space | SpaceDeveloper | | ` space-auditor ` | A service account for auditing configuration and monitoring events,
20- initially limited to a single space | SpaceAuditor |
16+ Plan Name | Description | Cloud Foundry Role
17+ --------- | ----------- | -------------------|
18+ ` space-deployer ` | A service account for continuous deployment, initially limited to a single space | SpaceDeveloper |
19+ ` space-auditor ` | A service account for auditing configuration and monitoring events, initially limited to a single space | SpaceAuditor |
2120
2221The ` space-deployer ` service account is assigned the ` SpaceDeveloper ` role in the space (pushing apps, provisioning
23- services, etc). The ` space-auditor ` service account is assigned the ` SpaceAuditor ` role in the space (read-only access).
22+ services, etc).
23+ The ` space-auditor ` service account is assigned the ` SpaceAuditor ` role in the space (read-only access).
2424For details on the capabilities associated with the SpaceDeveloper and SpaceAuditor roles, please see the Cloud Foundry
2525documentation: https://docs.cloudfoundry.org/concepts/roles.html .
2626
@@ -35,23 +35,35 @@ _These instances are available in [sandbox spaces](/docs/pricing/free-limited-sa
3535
3636To create a service instance that can provision service accounts, run the following command:
3737
38- ``` bash cf create-service cloud-gov-service-account space-deployer my-service-account ```
38+ ``` bash
39+ cf create-service cloud-gov-service-account space-deployer my-service-account
40+ ```
3941
4042If your service account only requires read access and does not need the ability to deploy applications, use the
4143` space-auditor ` plan instead:
4244
43- ``` bash cf create-service cloud-gov-service-account space-auditor my-service-account ```
45+ ``` bash
46+ cf create-service cloud-gov-service-account space-auditor my-service-account
47+ ```
4448
4549## Obtaining credentials
4650
4751To create a service account, bind a [ service key] ( https://docs.cloudfoundry.org/devguide/services/service-keys.html ) to
4852the service instance:
4953
50- ``` bash cf create-service-key my-service-account my-service-key cf service-key my-service-account my-service-key ```
54+ ``` bash
55+ cf create-service-key my-service-account my-service-key
56+ cf service-key my-service-account my-service-key
57+ ```
5158
5259The last command will return a username/password pair, that you can use, like this:
5360
54- ``` json { "password": "oYasdfliaweinasfdliecV", "username": "deadbeed-aabb-1234-feha0987654321000" } ```
61+ ``` json
62+ {
63+ "password" : " oYasdfliaweinasfdliecV" ,
64+ "username" : " deadbeed-aabb-1234-feha0987654321000"
65+ }
66+ ```
5567
5668This will create a cloud.gov service account and make the credentials available to you via a service key. Keep these
5769credentials secure. If they’re compromised, the way to invalidate the credentials is to [ delete the service
@@ -94,14 +106,19 @@ service key.
94106
95107Service account passwords expire every 90 days. If you see an error like:
96108
97- ``` bash Error Code: 403 Raw Response: {"error":"access_denied","error_description":"Your current password has expired.
98- Please reset your password." } ` ` `
109+ ``` bash
110+ Error Code: 403
111+ Raw Response: {" error" :" access_denied" ," error_description" :" Your current password has expired. Please reset your password." }
112+ ```
99113
100114Then you'll need to delete the existing service key, recreate it, and update the username/password in your deployment
101115scripts. For example:
102116
103- ```bash cf delete-service-key my-service-account my-service-key cf create-service-key my-service-account my-service-key
104- cf service-key my-service-account my-service-key ```
117+ ``` bash
118+ cf delete-service-key my-service-account my-service-key
119+ cf create-service-key my-service-account my-service-key
120+ cf service-key my-service-account my-service-key
121+ ```
105122
106123The last command will return the service account username/password pair. These steps can be used at any time to
107124update/rotate credentials for service accounts.
0 commit comments