This page describes how to assign a specific service account to your Cloud Run (fully managed) service.
Setting and updating service identity
It is recommended that you give each of your services a dedicated identity and restrict what it is able to access by granting it a minimal set of permissions using IAM. You can do this by assigning a named service account that has the correct IAM role(s). You can only use service accounts in the same project as the Cloud Run (fully managed) service.
Permissions required to use non-default identities
In order to deploy a service with a non-default service account, the deployer
must have the
iam.serviceAccounts.actAs permission on the service account
If a user creates a service account, that user is automatically granted this permission; otherwise, a user with the correct permissions must grant the deployer this permission on the service account in order for the user to deploy.
Deploying a new service with a non-default identity
Before you deploy a service with a new identity, make sure that the service account you want to use is already created. If not, learn how to create and manage service accounts.
Click CREATE SERVICE if you are configuring a service account on a new service you are deploying to. If you are configuring a service account on an existing service, then click on the service, then click DEPLOY NEW REVISION.
Click SHOW OPTIONAL SETTINGS.
Click the Service account dropdown and select the desired service account.
Click Create or Deploy.
You can update an existing service to have a new runtime service account by using the following command:
gcloud run services update SERVICE --service-account SERVICE_ACCOUNT_EMAIL
- SERVICE with the name of your service.
- SERVICE_ACCOUNT_EMAIL with the service account email associated with the new identity.
You can also set a service account during deployment using the command:
gcloud run deploy --image gcr.io/PROJECT-ID/IMAGE --service-account SERVICE_ACCOUNT_EMAIL
- PROJECT-ID with your project name
- IMAGE with the container image you are deploying
- SERVICE_ACCOUNT_EMAIL with the service account associated with the new identity