How can I see the service account that the python bigquery client uses?

Question

To create a default bigquery client I use:

from google.cloud import bigquery
client = bigquery.Client()

This uses the (default) credentials available in the environment.

But how I see then which (default) service account is used?

Answer 1

This led me in the right direction:
Google BigQuery Python Client using the wrong credentials

To see the service-account used you can do:

client._credentials.service_account_email

However:
This statement above works when you run it on a jupyter notebook (in Vertex AI), but when you run it in a cloud function with print(client._credentials.service_account_email) then it just logs 'default' to Cloud Logging. But the default service account for a Cloud Function should be: <project_id>@appspot.gserviceaccount.com.

This will also give you the wrong answer:

client.get_service_account_email()

The call to client.get_service_account_email() does not return the credential's service account email address. Instead, it returns the BigQuery service account email address used for KMS encryption/decryption.

Answer 2

While you can interrogate the credentials directly (be it json keys, metadata server, etc), I have occasionally found it valuable to simply query bigquery using the SESSION_USER() function.

Something quick like this should suffice:

client = bigquery.Client()
query_job = client.query("SELECT SESSION_USER() as whoami")
results = query_job.result()
for row in results:
    print("i am {}".format(row.whoami))