The following procedure details how to embed a Google Cloud KMS key as a Service Account.
There are two ways to associate a Service Account with a KMS key:
Create a private key within KMS and then associate a Service Account with it. or Create a Service Account keypair; export the private key and import that key into KMS. Once the Serivce Account private key is within KMS, you can do several things: