[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[[["\u003cp\u003eThis content outlines how to manage access control for Cloud Run functions (1st gen) using Identity and Access Management (IAM) roles at the project level.\u003c/p\u003e\n"],["\u003cp\u003eUsers can be assigned basic roles like \u003cstrong\u003eEditor\u003c/strong\u003e, \u003cstrong\u003eOwner\u003c/strong\u003e, and \u003cstrong\u003eViewer\u003c/strong\u003e, or Cloud Run functions-specific roles like \u003cstrong\u003eDeveloper\u003c/strong\u003e and \u003cstrong\u003eViewer\u003c/strong\u003e, which dictate read and write access to functions and other project resources.\u003c/p\u003e\n"],["\u003cp\u003eService accounts, including the App Engine default service account and the Cloud Run functions Service Agent, play crucial roles in function execution and administration, each with specific permissions.\u003c/p\u003e\n"],["\u003cp\u003eThe Google Cloud Run functions Service Agent service account (\u003ccode\u003eservice-PROJECT_NUMBER@gcf-admin-robot.iam.gserviceaccount.com\u003c/code\u003e) is essential for administrative actions like creating, updating, and deleting functions, with its permissions being critical to maintain.\u003c/p\u003e\n"],["\u003cp\u003eTroubleshooting steps are provided for common permission errors during function deployment, execution, and management, including verifying user roles, service agent permissions, and trigger source access.\u003c/p\u003e\n"]]],[],null,["# Access control with IAM (1st gen)\n=================================\n\nYou (that is, the user or service account deploying the function) can set access\ncontrol using roles at the project level. Grant a role to a\nproject member or service account to determine the level of access to your\nGoogle Cloud project and its resources. By default, all Google Cloud projects come\nwith a single user: the original project creator. No other users have access to\nthe project, and therefore, access to functions, until a user is added as a\nproject team member.\n\nAccess control for users\n------------------------\n\nYou can add users as team members to your project and grant them roles using\n[Identity and Access Management (IAM)](/iam/docs/overview).\n\nCloud Run functions supports the\n[basic roles](/iam/docs/understanding-roles#bas8c) of **Editor** ,\n**Owner** , and **Viewer**, which give the following permissions:\n\n- **Editor** and **Owner**: Read and write access to all functions-related resources. Lets users deploy, update, and delete functions. Additional access to other resources in the project.\n- **Viewer**: Read-only access to functions and locations. Lets users list functions and see their details, but does not let them view the source code. Additional access to other resources in the project.\n\nCloud Run functions also supports the Cloud Run functions\n[predefined **Developer** and **Viewer** roles](/functions/docs/reference/iam/roles),\nwhich give the following permissions:\n\n- **Developer**: Read and write access to all functions-related resources. Lets users deploy, update, and delete functions. No access to other resources in the project.\n- **Viewer**: Read-only access to functions and locations. Lets users list functions and see their details, but does not let them view the source code. No access to other resources in the project.\n\n| **Note:** To write or access Cloud Run functions logs, a project member must also have the appropriate logging permissions. For more information, see the [Cloud Logging access control guide](/logging/docs/access-control).\n\nAccess control for service accounts\n-----------------------------------\n\nA\n[service account](/iam/docs/service-account-types) is a special type of\nGoogle Cloud account that acts as an identity for a non-human user that needs to\nauthenticate and be authorized to access data and perform various actions. Some\nof these accounts are\n[created and managed by Google itself](/iam/docs/service-account-types#google-managed)\nand are known as\n[*service agents*](/iam/docs/service-agents).\n\nThe following service accounts are used for Cloud Run functions:\n\n### Runtime service accounts\n\nAt runtime, Cloud Run functions defaults to using the App Engine\ndefault service account (`PROJECT_ID@appspot.gserviceaccount.com`), which has\nthe **Editor** role on the project. You can change the role of this service\naccounts to limit or extend the permissions for your running functions. You can\nalso change which service account is used by\n[providing a non-default individual service account](/functions/1stgendocs/securing/function-identity#individual).\n\nTo learn more about service accounts, see the\n[service accounts documentation](/iam/docs/understanding-service-accounts).\n| **Note:** Authenticating as the runtime service account from inside your function might fail if you change the Cloud Run functions service account's permissions.\n\n### Administrative service accounts\n\nTo perform administrative actions on your project during the creation,\nupdating, or deletion of functions, all projects in Cloud Run functions\nrequire the Google Cloud Run functions Service Agent service account\n(`service-PROJECT_NUMBER@gcf-admin-robot.iam.gserviceaccount.com`).\n\nIn addition, all runtimes carry out container image building and storage within\nyour project. To support this, you also need to provision the following:\n\n- The basic [Cloud Build service account](/build/docs/cloud-build-service-account) (`PROJECT_NUMBER@cloudbuild.gserviceaccount.com`)\n- The [Cloud Build Service Agent service account](/iam/docs/understanding-roles#service-management-roles) (`service-PROJECT_NUMBER@gcp-sa-cloudbuild.iam.gserviceaccount.com`)\n- The [Google Container Registry Service Agent service account](/container-registry/docs/overview#container_registry_service_account) (`service-PROJECT_NUMBER@containerregistry.iam.gserviceaccount.com`)\n\nThese service accounts should have the roles listed in the earlier\n[table](#roles).\n\n#### Google Cloud Run functions Service Agent service account\n\nBy default, the Google Cloud Run functions Service Agent service account\n(`service-PROJECT_NUMBER@gcf-admin-robot.iam.gserviceaccount.com` has\nthe **cloudfunctions.serviceAgent** role on your project.\n| **Warning:** If you remove the default role binding or modify the permissions granted to the Cloud Run functions Service Agent service account on your Google Cloud project, the Cloud Run functions create, update, and delete operations might fail.\n\nHere's a few of the notable permissions that the `cloudfunctions.serviceAgent`\nuses:\n\nYou can see the entire set of permissions under the [predefined IAM roles](/iam/docs/understanding-roles#cloudfunctions.serviceAgent)\nor by running this command: \n\n```bash\ngcloud iam roles describe roles/cloudfunctions.serviceAgent\n```\n\n\u003cbr /\u003e\n\nYou can reset this service account to the default role by removing whatever role\nit has and adding the Cloud Run functions Service Agent role: \n\n```bash\ngcloud projects add-iam-policy-binding PROJECT_ID \\\n --member serviceAccount:service-PROJECT_NUMBER@gcf-admin-robot.iam.gserviceaccount.com \\\n --role roles/cloudfunctions.serviceAgent\n```\n\nTroubleshooting permission errors\n---------------------------------\n\nIf you get permission errors when you deploy, update, delete, or execute\nfunctions in your project, perform the following steps:\n\n1. Make sure that you have the **Editor** or **Owner** role on your project, or\n that you are using the **Cloud Run functions Developer** role.\n\n If you are using the **Cloud Run functions Developer** role at the project\n level, also ensure that you have\n [granted the user the **IAM Service Account User** role](/functions/docs/reference/iam/roles#additional-configuration).\n\n Only execution permissions are allowed at the per-function level.\n2. Verify that the Cloud Run functions Service Agent service account\n (`service-PROJECT_NUMBER@gcf-admin-robot.iam.gserviceaccount.com`) has the\n **cloudfunctions.serviceAgent** role for your project.\n\n Make sure the **Include Google-provided role grants** box on the\n **Permissions** tab of the [Console IAM](https://console.cloud.google.com/iam-admin/iam/) page\n is checked to see this account. Or you can use\n `gcloud projects add-iam-policy-binding PROJECT_ID`.\n3. Ensure that you have permissions for trigger sources, such as\n [Pub/Sub](/functions/1stgendocs/calling/pubsub) or\n [Cloud Storage](/functions/1stgendocs/calling/storage).\n\nIf you get an \"insufficient permissions\" error, or have other\nauthentication problems when you run your functions, make sure that the runtime\nservice account has the correct permissions to access the resources your\nfunctions need. Then, repeat steps 2 and 3.\n\nIf you get a \"service unavailable\" error during deployment, make\nsure that the runtime service account `PROJECT_ID@appspot.gserviceaccount.com`\nexists in your project. To recreate this service account if it was deleted, see\n[Undeleting a service account](/iam/docs/service-accounts-delete-undelete#undeleting).\n\nSee also [Troubleshooting Cloud Run functions](/functions/1stgendocs/troubleshooting)."]]
