Tieni presente che all'account di servizio Cloud Build legacy viene assegnato automaticamente il ruolo Account di servizio Cloud Build per il progetto. L'account di servizio predefinito Compute Engine non include questo ruolo. Puoi concedere altre autorizzazioni a qualsiasi account servizio in uso.
Concedi un ruolo all'account di servizio Cloud Build predefinito utilizzando la pagina Impostazioni
Puoi concedere determinati ruoli IAM di uso comune all'account di servizio Cloud Build predefinito utilizzando la pagina Impostazioni di Cloud Build nella Google Cloud console:
Viene visualizzata la pagina Autorizzazioni account di servizio:
Utilizza il menu a discesa per selezionare il service account da aggiornare.
Imposta lo stato del ruolo che vuoi aggiungere su Attiva.
Concedi un ruolo all'account di servizio Cloud Build predefinito utilizzando la pagina IAM
Se il ruolo che vuoi concedere non è elencato nella pagina Impostazioni di Cloud Build
nella Google Cloud console, utilizza la pagina IAM per concedere il ruolo:
Sopra la tabella delle autorizzazioni, seleziona la casella di controllo Includi concessioni di ruoli fornite da Google.
Nella tabella delle autorizzazioni vengono visualizzate più righe.
Nella tabella delle autorizzazioni, trova il tuo account di servizio Cloud Build predefinito.
Fai clic sull'icona a forma di matita.
Individua il ruolo che vuoi revocare e fai clic sul cestino di eliminazione accanto al ruolo.
Concedi un ruolo all'agente di servizio Cloud Build
Oltre all'account di servizio predefinito di Cloud Build, Cloud Build dispone di un agente di servizio Cloud Build che consente ad altri Google Cloud servizi di accedere alle tue risorse. Dopo aver attivato l'API Cloud Build, l'agente di servizio viene creato automaticamente nel progettoGoogle Cloud . L'agente di servizio ha il seguente formato, dove
PROJECT_NUMBER è il numero del progetto.
Per visualizzare l'agente di servizio di un progetto, vai alla pagina IAM nella Google Cloud console e seleziona la casella di controllo Mostra account di servizio gestiti da Google.
Se hai revocato accidentalmente il ruolo dell'agente di servizio Cloud Build nel tuo progetto, puoi concederlo manualmente seguendo questi passaggi:
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-08 UTC."],[[["\u003cp\u003eThis document explains how to manage permissions for the default Cloud Build service account, including granting and revoking roles.\u003c/p\u003e\n"],["\u003cp\u003eYou can use either the Cloud Build Settings page or the IAM page in the Google Cloud console to grant roles to the default Cloud Build service account.\u003c/p\u003e\n"],["\u003cp\u003eTo revoke a role from the default Cloud Build service account, you must use the IAM page in the Google Cloud console.\u003c/p\u003e\n"],["\u003cp\u003eThe Cloud Build service agent, which allows other Google Cloud services to access your resources, is automatically created when you enable the Cloud Build API.\u003c/p\u003e\n"],["\u003cp\u003eIf you accidentally revoke the Cloud Build service agent's role, you can manually grant it back by using the IAM page or by using the \u003ccode\u003egcloud\u003c/code\u003e command-line tool.\u003c/p\u003e\n"]]],[],null,["# Configure access for the default Cloud Build service account\n\n| **Note:** We have introduced changes to the default service account used to run builds. As a best practice, we recommend that you [specify your own service\n| account](/build/docs/securing-builds/configure-user-specified-service-accounts) to run your builds. For more information see [Cloud Build default\n| service account change](/build/docs/cloud-build-service-account-updates).\n\nThis page explains how to grant permissions to and revoke permissions from the\n[default Cloud Build service account](/build/docs/cloud-build-service-account).\n\nNote that the legacy Cloud Build service account is automatically\ngranted the Cloud Build Service Account role for the project. The\n[Compute Engine default service account](/compute/docs/access/service-accounts#default_service_account)\ndoesn't include this role. You can grant more permissions to whatever service\naccount you're using.\n\nBefore you begin\n----------------\n\n- Understand [Cloud Build roles and permissions](/build/docs/iam-roles-permissions).\n- Read [Default Cloud Build service account](/build/docs/cloud-build-service-account).\n\nGrant a role to the default Cloud Build service account using the Settings page\n-------------------------------------------------------------------------------\n\nYou can grant certain commonly used IAM roles to the default\nCloud Build service account using the Cloud Build Settings page in the Google Cloud console:\n\n1. Open the Cloud Build Settings page:\n\n [Open the Cloud Build Settings page](https://console.cloud.google.com/cloud-build/settings)\n\n You'll see the **Service account permissions** page:\n\n2. Use the drop-down menu to select the service account you want to update.\n\n3. Set the status of the role you want to add to **Enable**.\n\nGrant a role to the default Cloud Build service account using the IAM page\n--------------------------------------------------------------------------\n\nIf the role you want to grant is not listed in the Cloud Build Settings page\nin the Google Cloud console, use the IAM page to grant the role:\n\n1. Open the IAM page:\n\n [Open the IAM page](https://console.cloud.google.com/iam-admin/iam)\n2. Select your Google Cloud project.\n\n3. Above the permissions table, select the\n **Include Google-provided role grants** checkbox.\n\n You'll see that more rows appear in the permissions table.\n4. In the permissions table, find your default Cloud Build service\n account.\n\n5. Click the pencil icon.\n\n6. Select the role you want to grant to the Cloud Build service\n account.\n\n7. Click **Save**.\n\nRevoke a role from the Cloud Build service account\n--------------------------------------------------\n\n1. Open the IAM page:\n\n [Open the IAM page](https://console.cloud.google.com/iam-admin/iam)\n2. Select your Google Cloud project.\n\n3. Above the permissions table, select the\n **Include Google-provided role grants** checkbox.\n\n You'll see that more rows appear in the permissions table.\n4. In the permissions table, find your default Cloud Build service\n account.\n\n5. Click the pencil icon.\n\n6. Locate the role you want to revoke and click the delete trash can next to the\n role.\n\nGrant a role to the Cloud Build service agent\n---------------------------------------------\n\nIn addition to the Cloud Build default service account,\nCloud Build has a *Cloud Build service agent* that allows\nother Google Cloud services to access your resources. After you enable the\nCloud Build API, the service agent is automatically created in the\nGoogle Cloud project. The service agent has the following format, where\n\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e is your project number. \n\n service-\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003ePROJECT_NUMBER\u003c/span\u003e\u003c/var\u003e@gcp-sa-cloudbuild.iam.gserviceaccount.com\n\nYou can view the service agent for a project by going to the\n[IAM page in the Google Cloud console](https://console.cloud.google.com/iam-admin/iam)\npage and selecting the **Show google managed service accounts** checkbox.\n\nIf you've accidentally revoked the Cloud Build service agent's role\non your project, you can grant it manually using the following steps: \n\n### Console\n\n1. Open the **IAM** page in the Google Cloud console:\n\n [Open the IAM page](https://console.cloud.google.com/iam-admin/iam)\n2. Click **Grant access**.\n\n3. Add the following principal, where \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e\n is your project number:\n\n service-\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e@gcp-sa-cloudbuild.iam.gserviceaccount.com\n\n4. Select **Service Agents** \\\u003e **Cloud Build Service Agent** as your role.\n\n5. Click **Save**.\n\n### gcloud\n\nGrant `roles/cloudbuild.serviceAgent` IAM role to the\nCloud Build service agent: \n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member=\"serviceAccount:service-\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e@gcp-sa-cloudbuild.iam.gserviceaccount.com\" \\\n --role=\"roles/cloudbuild.serviceAgent\"\n\nReplace the placeholder values in the command with the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: The project ID\n- \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: The project number\n\nWhat's next\n-----------\n\n- Learn about [user-specified service accounts](/build/docs/securing-builds/configure-user-specified-service-accounts).\n- Learn about [service accounts in depth](/iam/docs/understanding-service-accounts).\n- Learn about [configuring access to Cloud Build resources](/build/docs/securing-builds/configure-access-to-resources).\n- Learn about [the permissions required to view build logs](/build/docs/securing-builds/store-view-build-logs)."]]
