Configure access for the default Cloud Build service account

Note: We have introduced changes to the default service account used to run builds. As a best practice, we recommend that you specify your own service account to run your builds. For more information see Cloud Build default service account change.

This page explains how to grant permissions to and revoke permissions from the default Cloud Build service account.

Note that the legacy Cloud Build service account is automatically granted the Cloud Build Service Account role for the project. The Compute Engine default service account doesn't include this role. You can grant more permissions to whatever service account you're using.

Before you begin

• Understand Cloud Build roles and permissions.
• Read Default Cloud Build service account.

Grant a role to the default Cloud Build service account using the Settings page

You can grant certain commonly used IAM roles to the default Cloud Build service account using the Cloud Build Settings page in the Google Cloud console:

1. Open the Cloud Build Settings page:

   Open the Cloud Build Settings page

   You'll see the Service account permissions page:

   

2. Use the drop-down menu to select the service account you want to update.

3. Set the status of the role you want to add to Enable.

Grant a role to the default Cloud Build service account using the IAM page

If the role you want to grant is not listed in the Cloud Build Settings page in the Google Cloud console, use the IAM page to grant the role:

1. Open the IAM page:

   Open the IAM page

2. Select your Google Cloud project.

3. Above the permissions table, select the Include Google-provided role grants checkbox.

   You'll see that more rows appear in the permissions table.

4. In the permissions table, find your default Cloud Build service account.

5. Click the pencil icon.

6. Select the role you want to grant to the Cloud Build service account.

7. Click Save.

Revoke a role from the Cloud Build service account

1. Open the IAM page:

   Open the IAM page

2. Select your Google Cloud project.

3. Above the permissions table, select the Include Google-provided role grants checkbox.

   You'll see that more rows appear in the permissions table.

4. In the permissions table, find your default Cloud Build service account.

5. Click the pencil icon.

6. Locate the role you want to revoke and click the delete trash can next to the role.

Grant a role to the Cloud Build service agent

In addition to the Cloud Build default service account, Cloud Build has a Cloud Build service agent that allows other Google Cloud services to access your resources. After you enable the Cloud Build API, the service agent is automatically created in the Google Cloud project. The service agent has the following format, where PROJECT_NUMBER is your project number.

     [e-mail]

You can view the service agent for a project by going to the IAM page in the Google Cloud console page and selecting the Show google managed service accounts checkbox.

If you've accidentally revoked the Cloud Build service agent's role on your project, you can grant it manually using the following steps:

Console

1. Open the IAM page in the Google Cloud console:

   Open the IAM page

2. Click Grant access.

3. Add the following principal, where PROJECT_NUMBER is your project number:

   [e-mail]
   

4. Select Service Agents > Cloud Build Service Agent as your role.

5. Click Save.

gcloud

Grant roles/cloudbuild.serviceAgent IAM role to the Cloud Build service agent:

gcloud projects add-iam-policy-binding PROJECT_ID \
    --member="serviceAccount:[e-mail]" \
    --role="roles/cloudbuild.serviceAgent"

Replace the placeholder values in the command with the following:

• PROJECT_ID: The project ID
• PROJECT_NUMBER: The project number

What's next

• Learn about user-specified service accounts.
• Learn about service accounts in depth.
• Learn about configuring access to Cloud Build resources.
• Learn about the permissions required to view build logs.