The following table describes Identity and Access Management (IAM) roles that are associated with Cloud Run, and lists the permissions that are contained in each role.
Roles can be granted to users on an entire project or on individual services. Read Managing Access via IAM to learn more.
||Can create, update, and delete services.Can get and set IAM policies.Requires additional configuration in order to deploy services.||
||Can view services.Can get IAM policies.||
||Can invoke services.||
For a reference describing the IAM roles contained in each IAM permission, refer to Cloud Run IAM Permissions.
For developers that want to define their own roles containing bundles of permissions that they specify, IAM offers custom roles.
If the role contains permissions that let a developer deploy services, then you must perform the additional configuration below.
A user needs the following permissions to deploy new Cloud Run services or revisions:
run.services.updateon the project level. Typically assigned through the
roles/run.adminrole. It can be changed in the project permissions admin page.
iam.serviceAccounts.actAsfor the Cloud Run runtime service account. By default, this is
PROJECT_NUMBERemail@example.com. The permission is typically assigned through the
To assign the IAM Service Account User role on the Cloud Run runtime service account:
Go to the Service accounts page of the Google Cloud Console:
Select the Runtime Service Account (
PROJECT_NUMBERfirstname.lastname@example.org) from the table.
Click Show Info Panel in the top right corner to show the Permissions tab.
Click the Add member button.
Enter the member (e.g. user or group email) that that matches the member you're granting the Admin or Developer role to.
In the Select a role dropdown, select the Service Accounts > Service Account User role.
- Use the
gcloud iam service-accounts add-iam-policy-bindingcommand, replacing
[VALUES_IN_BRACKETS]with appropriate values:
gcloud iam service-accounts add-iam-policy-binding \ PROJECT_NUMBERemail@example.com \ --member="[MEMBER]" \ --role="roles/iam.serviceAccountUser"
Optional permissions for Cloud Run users
The following optional permissions can be considered when configuring accounts with minimal permission set:
monitoring.timeSeries.liston the project level. Typically assigned through the
roles/monitoring.viewerrole. It allows user to access metrics generated by their service. For more information, go to the Stackdriver documentation for Access Control.
logging.logEntries.liston the project level. Typically assigned through the
roles/logging.viewerrole. It allows user to access logs generated by their service. For more information, go to the Access Control guide in the Stackdriver Logging documentation.