service account key also from a resource