Cloud Build는 사용자 대신 기본 서비스 계정을 사용하여 빌드를 실행합니다. 예를 들어 Cloud Build 기존 서비스 계정이 생성될 때는 프로젝트에 대해 Cloud Build 서비스 계정 역할이 자동으로 부여됩니다. 이 역할은 서비스 계정에 여러 작업을 수행할 수 있는 권한을 제공하지만, 서비스 계정에 대해 권한을 더 부여해서 추가 작업을 수행할 수 있습니다. 이 페이지에서는 기본 Cloud Build 서비스 계정에 대해 권한을 부여 및 취소하는 방법을 설명합니다.
Cloud Build 기본 서비스 계정 외에도 Cloud Build에는 다른 Google Cloud 서비스가 리소스에 액세스하도록 허용하는 Cloud Build 서비스 에이전트가 있습니다. Cloud Build API를 사용 설정한 후 Google Cloud 프로젝트에 서비스 에이전트가 자동으로 생성됩니다. 서비스 에이전트의 형식은 다음과 같습니다. 여기서 PROJECT_NUMBER는 프로젝트 번호입니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-21(UTC)"],[[["\u003cp\u003eThis document explains how to manage permissions for the default Cloud Build service account, including granting and revoking roles.\u003c/p\u003e\n"],["\u003cp\u003eYou can use either the Cloud Build Settings page or the IAM page in the Google Cloud console to grant roles to the default Cloud Build service account.\u003c/p\u003e\n"],["\u003cp\u003eTo revoke a role from the default Cloud Build service account, you must use the IAM page in the Google Cloud console.\u003c/p\u003e\n"],["\u003cp\u003eThe Cloud Build service agent, which allows other Google Cloud services to access your resources, is automatically created when you enable the Cloud Build API.\u003c/p\u003e\n"],["\u003cp\u003eIf you accidentally revoke the Cloud Build service agent's role, you can manually grant it back by using the IAM page or by using the \u003ccode\u003egcloud\u003c/code\u003e command-line tool.\u003c/p\u003e\n"]]],[],null,["# Configure access for the default Cloud Build service account\n\n| **Note:** We have introduced changes to the default service account used to run builds. As a best practice, we recommend that you [specify your own service\n| account](/build/docs/securing-builds/configure-user-specified-service-accounts) to run your builds. For more information see [Cloud Build default\n| service account change](/build/docs/cloud-build-service-account-updates).\n\nThis page explains how to grant permissions to and revoke permissions from the\n[default Cloud Build service account](/build/docs/cloud-build-service-account).\n\nNote that the legacy Cloud Build service account is automatically\ngranted the Cloud Build Service Account role for the project. The\n[Compute Engine default service account](/compute/docs/access/service-accounts#default_service_account)\ndoesn't include this role. You can grant more permissions to whatever service\naccount you're using.\n\nBefore you begin\n----------------\n\n- Understand [Cloud Build roles and permissions](/build/docs/iam-roles-permissions).\n- Read [Default Cloud Build service account](/build/docs/cloud-build-service-account).\n\nGrant a role to the default Cloud Build service account using the Settings page\n-------------------------------------------------------------------------------\n\nYou can grant certain commonly used IAM roles to the default\nCloud Build service account using the Cloud Build Settings page in the Google Cloud console:\n\n1. Open the Cloud Build Settings page:\n\n [Open the Cloud Build Settings page](https://console.cloud.google.com/cloud-build/settings)\n\n You'll see the **Service account permissions** page:\n\n2. Use the drop-down menu to select the service account you want to update.\n\n3. Set the status of the role you want to add to **Enable**.\n\nGrant a role to the default Cloud Build service account using the IAM page\n--------------------------------------------------------------------------\n\nIf the role you want to grant is not listed in the Cloud Build Settings page\nin the Google Cloud console, use the IAM page to grant the role:\n\n1. Open the IAM page:\n\n [Open the IAM page](https://console.cloud.google.com/iam-admin/iam)\n2. Select your Google Cloud project.\n\n3. Above the permissions table, select the\n **Include Google-provided role grants** checkbox.\n\n You'll see that more rows appear in the permissions table.\n4. In the permissions table, find your default Cloud Build service\n account.\n\n5. Click the pencil icon.\n\n6. Select the role you want to grant to the Cloud Build service\n account.\n\n7. Click **Save**.\n\nRevoke a role from the Cloud Build service account\n--------------------------------------------------\n\n1. Open the IAM page:\n\n [Open the IAM page](https://console.cloud.google.com/iam-admin/iam)\n2. Select your Google Cloud project.\n\n3. Above the permissions table, select the\n **Include Google-provided role grants** checkbox.\n\n You'll see that more rows appear in the permissions table.\n4. In the permissions table, find your default Cloud Build service\n account.\n\n5. Click the pencil icon.\n\n6. Locate the role you want to revoke and click the delete trash can next to the\n role.\n\nGrant a role to the Cloud Build service agent\n---------------------------------------------\n\nIn addition to the Cloud Build default service account,\nCloud Build has a *Cloud Build service agent* that allows\nother Google Cloud services to access your resources. After you enable the\nCloud Build API, the service agent is automatically created in the\nGoogle Cloud project. The service agent has the following format, where\n\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e is your project number. \n\n service-\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003ePROJECT_NUMBER\u003c/span\u003e\u003c/var\u003e@gcp-sa-cloudbuild.iam.gserviceaccount.com\n\nYou can view the service agent for a project by going to the\n[IAM page in the Google Cloud console](https://console.cloud.google.com/iam-admin/iam)\npage and selecting the **Show google managed service accounts** checkbox.\n\nIf you've accidentally revoked the Cloud Build service agent's role\non your project, you can grant it manually using the following steps: \n\n### Console\n\n1. Open the **IAM** page in the Google Cloud console:\n\n [Open the IAM page](https://console.cloud.google.com/iam-admin/iam)\n2. Click **Grant access**.\n\n3. Add the following principal, where \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e\n is your project number:\n\n service-\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e@gcp-sa-cloudbuild.iam.gserviceaccount.com\n\n4. Select **Service Agents** \\\u003e **Cloud Build Service Agent** as your role.\n\n5. Click **Save**.\n\n### gcloud\n\nGrant `roles/cloudbuild.serviceAgent` IAM role to the\nCloud Build service agent: \n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member=\"serviceAccount:service-\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e@gcp-sa-cloudbuild.iam.gserviceaccount.com\" \\\n --role=\"roles/cloudbuild.serviceAgent\"\n\nReplace the placeholder values in the command with the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: The project ID\n- \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: The project number\n\nWhat's next\n-----------\n\n- Learn about [user-specified service accounts](/build/docs/securing-builds/configure-user-specified-service-accounts).\n- Learn about [service accounts in depth](/iam/docs/understanding-service-accounts).\n- Learn about [configuring access to Cloud Build resources](/build/docs/securing-builds/configure-access-to-resources).\n- Learn about [the permissions required to view build logs](/build/docs/securing-builds/store-view-build-logs)."]]
