[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Set build service account (source deploy)\n\nDuring source deployments, Cloud Run leverages Cloud Build\nwhen building and deploying your Cloud Run service.\n\nThis page shows how to set a\n[user-specified service account](/build/docs/cloud-build-service-account#user_access_to_triggers)\nfor Cloud Build to use when executing builds of the service on your behalf.\nThis guide is relevant for platform developers who are deploying\nCloud Run [services](/run/docs/deploying-source-code) or\n[functions](/run/docs/deploy-functions) using the Google Cloud CLI and need to\ncustomize the build service account used by Cloud Build. The build service\naccount gcloud CLI flag is supported for\n[source deployments](/run/docs/deploying-source-code) (`--source`), and not\nsupported for [container image deployments](/run/docs/deploying) (`--image`).\n\nBefore you begin\n----------------\n\n1. Enable the Cloud Build API:\n\n ```bash\n gcloud services enable cloudbuild.googleapis.com\n ```\n2. [Create a service account](/iam/docs/service-accounts-create), or have an\n existing service account, to use as the Cloud Build service\n account.\n\n### Required roles\n\nYou or your administrator must grant the deployer account and the\nCloud Build service account the following IAM roles. \n\n#### Click to view required roles for the deployer account\n\nTo get the permissions that you need to build and deploy from source,\nask your administrator to grant you the following IAM\nroles:\n\n- [Cloud Run Source Developer](/iam/docs/understanding-roles#run.sourceDeveloper) (`roles/run.sourceDeveloper`) on your project\n- [Service Usage Consumer](/iam/docs/understanding-roles#serviceusage.serviceUsageConsumer) (`roles/serviceusage.serviceUsageConsumer`) on your project\n- [Service Account User](/iam/docs/understanding-roles#iam.serviceAccountUser) (`roles/iam.serviceAccountUser`) on the Cloud Run service identity \n\n#### Click to view required roles for the Cloud Build service account\n\nTo allow the Cloud Build service account to perform the build\nwhen deploying a function, ask your administrator to grant the\n[Cloud Run Builder](/iam/docs/understanding-roles#run.builder)\n(`roles/run.builder`) role to the Cloud Build service\naccount on the project.\n| **Note:** If you need to use a service account from a different project, you or your administrator must grant additional access to the service account. See [Cross-project set up](/build/docs/securing-builds/configure-user-specified-service-accounts#cross-project_set_up) for more details.\n\nFor a list of IAM roles and permissions that are associated with\nCloud Run, see\n[Cloud Run IAM roles](/run/docs/reference/iam/roles)\nand [Cloud Run IAM permissions](/run/docs/reference/iam/permissions).\nIf your Cloud Run service interfaces with\nGoogle Cloud APIs, such as Cloud Client Libraries, see the\n[service identity configuration guide](/run/docs/configuring/services/service-identity).\nFor more information about granting roles, see\n[deployment permissions](/run/docs/reference/iam/roles#additional-configuration)\nand [manage access](/iam/docs/granting-changing-revoking-access).\n\nSpecify a Cloud Build service account\n-------------------------------------\n\nBy default, if a Cloud Build service account isn't specified when\ndeploying a [service](/run/docs/deploying-source-code) or\n[function](/run/docs/deploy-functions#gcloud_1) from source,\nCloud Build uses the\n[default Cloud Build service account](/build/docs/cloud-build-service-account).\n\nAs a best practice for following the principle of least privilege to improve the\nsecurity posture of your service, we recommend that you specify your own service\naccount to run your builds when deploying a service from source. \n\n### gcloud\n\nTo specify the Cloud Build service account when deploying a\nservice from source code, use the `--build-service-account` flag: \n\n```bash\ngcloud run deploy SERVICE \\\n --source . \\\n --build-service-account projects/PROJECT_ID/serviceAccounts/BUILD_SERVICE_ACCOUNT\n```\n\nReplace:\n\n- \u003cvar translate=\"no\"\u003eSERVICE\u003c/var\u003e with name of your Cloud Run service.\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e the project ID where the build service account is created.\n- \u003cvar translate=\"no\"\u003eBUILD_SERVICE_ACCOUNT\u003c/var\u003e with a user-specified service account.\n\nIf you are deploying a function, add the `--function` flag with the function\nentry point from your source code."]]
