Cloud Run IAM roles

This page lists the Identity and Access Management (IAM) predefined roles for accessing Cloud Run resources.

Predefined roles

The following table describes IAM roles that are associated with Cloud Run, and lists the permissions that are contained in each role.

Roles can be granted to users on an entire project or on individual services. Read Managing access using IAM to learn more.

Roles only apply to Cloud Run services or jobs, they do not apply to Cloud Run domain mappings. The Project > Editor role is needed to create or update domain mappings.

Permissions

(roles/run.admin)

Full control over all Cloud Run resources.

Lowest-level resources where you can grant this role:

  • Cloud Run service
  • Cloud Run job

recommender.locations.*

recommender.runServiceCostInsights.*

recommender.runServiceCostRecommendations.*

recommender.runServiceIdentityInsights.*

recommender.runServiceIdentityRecommendations.*

recommender.runServicePerformanceInsights.*

recommender.runServicePerformanceRecommendations.*

recommender.runServiceSecurityInsights.*

recommender.runServiceSecurityRecommendations.*

resourcemanager.projects.get

resourcemanager.projects.list

run.*

(roles/run.builder)

Can build Cloud Run functions and source deployed services.

artifactregistry.repositories.deleteArtifacts

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.uploadArtifacts

logging.logEntries.create

source.repos.get

storage.objects.get

(roles/run.developer)

Read and write access to all Cloud Run resources.

Lowest-level resources where you can grant this role:

  • Cloud Run service
  • Cloud Run job

recommender.locations.*

recommender.runServiceCostInsights.*

recommender.runServiceCostRecommendations.*

recommender.runServiceIdentityInsights.*

recommender.runServiceIdentityRecommendations.*

recommender.runServicePerformanceInsights.*

recommender.runServicePerformanceRecommendations.*

recommender.runServiceSecurityInsights.*

recommender.runServiceSecurityRecommendations.*

resourcemanager.projects.get

resourcemanager.projects.list

run.configurations.*

run.executions.*

run.jobs.create

run.jobs.delete

run.jobs.get

run.jobs.getIamPolicy

run.jobs.list

run.jobs.listEffectiveTags

run.jobs.listTagBindings

run.jobs.run

run.jobs.runWithOverrides

run.jobs.update

run.locations.list

run.operations.*

run.revisions.*

run.routes.*

run.services.create

run.services.delete

run.services.get

run.services.getIamPolicy

run.services.list

run.services.listEffectiveTags

run.services.listTagBindings

run.services.update

run.tasks.*

(roles/run.invoker)

Can invoke Cloud Run services and execute Cloud Run jobs.

Lowest-level resources where you can grant this role:

  • Cloud Run service
  • Cloud Run job

run.jobs.run

run.routes.invoke

(roles/run.jobsExecutor)

Can excute and cancel Cloud Run jobs.

run.executions.cancel

run.jobs.run

(roles/run.jobsExecutorWithOverrides)

Can excute and cancel Cloud Run jobs with overrides.

run.executions.cancel

run.jobs.run

run.jobs.runWithOverrides

(roles/run.servicesInvoker)

Can invoke Cloud Run services.

run.routes.invoke

(roles/run.sourceDeveloper)

Deploy and manage Cloud Run source deployed resources.

artifactregistry.repositories.create

artifactregistry.repositories.get

artifactregistry.repositories.list

cloudbuild.builds.create

cloudbuild.builds.get

cloudbuild.builds.list

cloudbuild.builds.update

cloudbuild.operations.*

eventarc.channelConnections.create

eventarc.channelConnections.delete

eventarc.channelConnections.get

eventarc.channelConnections.getIamPolicy

eventarc.channelConnections.list

eventarc.channelConnections.publish

eventarc.channels.attach

eventarc.channels.create

eventarc.channels.delete

eventarc.channels.get

eventarc.channels.getIamPolicy

eventarc.channels.list

eventarc.channels.publish

eventarc.channels.undelete

eventarc.channels.update

eventarc.enrollments.create

eventarc.enrollments.delete

eventarc.enrollments.get

eventarc.enrollments.getIamPolicy

eventarc.enrollments.list

eventarc.enrollments.update

eventarc.googleApiSources.create

eventarc.googleApiSources.delete

eventarc.googleApiSources.get

eventarc.googleApiSources.getIamPolicy

eventarc.googleApiSources.list

eventarc.googleApiSources.update

eventarc.googleChannelConfigs.*

eventarc.locations.*

eventarc.operations.*

eventarc.pipelines.create

eventarc.pipelines.delete

eventarc.pipelines.get

eventarc.pipelines.getIamPolicy

eventarc.pipelines.list

eventarc.pipelines.update

eventarc.providers.*

eventarc.triggers.create

eventarc.triggers.delete

eventarc.triggers.get

eventarc.triggers.getIamPolicy

eventarc.triggers.list

eventarc.triggers.undelete

eventarc.triggers.update

orgpolicy.policy.get

pubsub.schemas.attach

pubsub.schemas.commit

pubsub.schemas.create

pubsub.schemas.delete

pubsub.schemas.get

pubsub.schemas.list

pubsub.schemas.listRevisions

pubsub.schemas.rollback

pubsub.schemas.validate

pubsub.snapshots.create

pubsub.snapshots.delete

pubsub.snapshots.get

pubsub.snapshots.list

pubsub.snapshots.seek

pubsub.snapshots.update

pubsub.subscriptions.consume

pubsub.subscriptions.create

pubsub.subscriptions.delete

pubsub.subscriptions.get

pubsub.subscriptions.list

pubsub.subscriptions.update

pubsub.topics.attachSubscription

pubsub.topics.create

pubsub.topics.delete

pubsub.topics.detachSubscription

pubsub.topics.get

pubsub.topics.list

pubsub.topics.publish

pubsub.topics.update

pubsub.topics.updateTag

recommender.locations.*

recommender.runServiceCostInsights.*

recommender.runServiceCostRecommendations.*

recommender.runServiceIdentityInsights.*

recommender.runServiceIdentityRecommendations.*

recommender.runServicePerformanceInsights.*

recommender.runServicePerformanceRecommendations.*

recommender.runServiceSecurityInsights.*

recommender.runServiceSecurityRecommendations.*

remotebuildexecution.blobs.get

resourcemanager.projects.get

resourcemanager.projects.list

run.configurations.*

run.executions.*

run.jobs.create

run.jobs.delete

run.jobs.get

run.jobs.getIamPolicy

run.jobs.list

run.jobs.listEffectiveTags

run.jobs.listTagBindings

run.jobs.run

run.jobs.runWithOverrides

run.jobs.update

run.locations.list

run.operations.*

run.revisions.*

run.routes.*

run.services.create

run.services.delete

run.services.get

run.services.getIamPolicy

run.services.list

run.services.listEffectiveTags

run.services.listTagBindings

run.services.update

run.tasks.*

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

storage.buckets.create

storage.buckets.get

storage.buckets.list

storage.folders.create

storage.folders.get

storage.folders.list

storage.managedFolders.create

storage.managedFolders.get

storage.managedFolders.list

storage.multipartUploads.abort

storage.multipartUploads.create

storage.multipartUploads.listParts

storage.objects.create

storage.objects.get

storage.objects.list

(roles/run.sourceViewer)

View Cloud Run source deployed resources.

artifactregistry.repositories.get

artifactregistry.repositories.list

cloudbuild.builds.get

cloudbuild.builds.list

cloudbuild.operations.*

eventarc.channelConnections.get

eventarc.channelConnections.getIamPolicy

eventarc.channelConnections.list

eventarc.channels.get

eventarc.channels.getIamPolicy

eventarc.channels.list

eventarc.enrollments.get

eventarc.enrollments.getIamPolicy

eventarc.enrollments.list

eventarc.googleApiSources.get

eventarc.googleApiSources.getIamPolicy

eventarc.googleApiSources.list

eventarc.googleChannelConfigs.get

eventarc.locations.*

eventarc.messageBuses.get

eventarc.messageBuses.getIamPolicy

eventarc.messageBuses.list

eventarc.messageBuses.use

eventarc.operations.get

eventarc.operations.list

eventarc.pipelines.get

eventarc.pipelines.getIamPolicy

eventarc.pipelines.list

eventarc.providers.*

eventarc.triggers.get

eventarc.triggers.getIamPolicy

eventarc.triggers.list

pubsub.schemas.get

pubsub.schemas.list

pubsub.schemas.listRevisions

pubsub.schemas.validate

pubsub.snapshots.get

pubsub.snapshots.list

pubsub.subscriptions.get

pubsub.subscriptions.list

pubsub.topics.get

pubsub.topics.list

recommender.locations.*

recommender.runServiceCostInsights.get

recommender.runServiceCostInsights.list

recommender.runServiceCostRecommendations.get

recommender.runServiceCostRecommendations.list

recommender.runServiceIdentityInsights.get

recommender.runServiceIdentityInsights.list

recommender.runServiceIdentityRecommendations.get

recommender.runServiceIdentityRecommendations.list

recommender.runServicePerformanceInsights.get

recommender.runServicePerformanceInsights.list

recommender.runServicePerformanceRecommendations.get

recommender.runServicePerformanceRecommendations.list

recommender.runServiceSecurityInsights.get

recommender.runServiceSecurityInsights.list

recommender.runServiceSecurityRecommendations.get

recommender.runServiceSecurityRecommendations.list

remotebuildexecution.blobs.get

resourcemanager.projects.get

resourcemanager.projects.list

run.configurations.*

run.executions.get

run.executions.list

run.jobs.get

run.jobs.getIamPolicy

run.jobs.list

run.jobs.listEffectiveTags

run.jobs.listTagBindings

run.locations.list

run.operations.get

run.operations.list

run.revisions.get

run.revisions.list

run.routes.get

run.routes.list

run.services.get

run.services.getIamPolicy

run.services.list

run.services.listEffectiveTags

run.services.listTagBindings

run.tasks.*

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

storage.folders.get

storage.folders.list

storage.managedFolders.get

storage.managedFolders.list

storage.objects.get

storage.objects.list

(roles/run.viewer)

Can view the state of all Cloud Run resources, including IAM policies.

Lowest-level resources where you can grant this role:

  • Cloud Run service
  • Cloud Run job

recommender.locations.*

recommender.runServiceCostInsights.get

recommender.runServiceCostInsights.list

recommender.runServiceCostRecommendations.get

recommender.runServiceCostRecommendations.list

recommender.runServiceIdentityInsights.get

recommender.runServiceIdentityInsights.list

recommender.runServiceIdentityRecommendations.get

recommender.runServiceIdentityRecommendations.list

recommender.runServicePerformanceInsights.get

recommender.runServicePerformanceInsights.list

recommender.runServicePerformanceRecommendations.get

recommender.runServicePerformanceRecommendations.list

recommender.runServiceSecurityInsights.get

recommender.runServiceSecurityInsights.list

recommender.runServiceSecurityRecommendations.get

recommender.runServiceSecurityRecommendations.list

resourcemanager.projects.get

resourcemanager.projects.list

run.configurations.*

run.executions.get

run.executions.list

run.jobs.get

run.jobs.getIamPolicy

run.jobs.list

run.jobs.listEffectiveTags

run.jobs.listTagBindings

run.locations.list

run.operations.get

run.operations.list

run.revisions.get

run.revisions.list

run.routes.get

run.routes.list

run.services.get

run.services.getIamPolicy

run.services.list

run.services.listEffectiveTags

run.services.listTagBindings

run.tasks.*

For a reference describing the IAM permissions contained in each IAM role, refer to Cloud Run IAM Permissions.

Custom roles

For developers that want to define their own roles containing bundles of permissions that they specify, IAM offers custom roles.

If the role contains permissions that let a developer deploy services, then you must perform the additional configuration below.

Deployment permissions

Cloud Run services and jobs run with a service identity.

To create or update Cloud Run resources, the deployer account must have access on the following resources:

  • The Cloud Run service or job
  • The Artifact Registry repository of the service or job's container image
  • The service account used as the service identity

By default, the service identity is the Compute Engine default service account. However, Google recommends using a user-managed service account with the most minimal set of permissions. See the service identity configuration pages for services and jobs for more details.

Select the appropriate expander arrow to learn about the required deployment permissions.

Click to view the required roles for deploying services or revisions

To get the permissions that you need to deploy services or revisions, you or your administrator must grant IAM roles to the deployer account on the following resources:

The following permissions are required to deploy services or revisions:

  • run.services.create to create services and run.services.update to update services
  • run.services.get and run.operations.get to read the status of the service
  • artifactregistry.repositories.downloadArtifacts on the repository container the container images of the service
  • iam.serviceAccounts.actAs on the service identity

You might also be able to get these permissions with custom roles or other predefined roles.

Click to view the required roles for executing jobs

To get the permissions that you need to execute jobs, you or your administrator must grant IAM roles to the deployer account on the following resources:

  • To create or update a job: Cloud Run Developer (roles/run.developer) on the Cloud Run job
  • To execute jobs or cancel job executions: Cloud Run Invoker (roles/run.invoker) on the Cloud Run job
  • Artifact Registry Reader (roles/artifactregistry.reader) on the Artifact Registry repository of the container images of the service
  • Service Account User (roles/iam.serviceAccountUser) on the Cloud Run service identity

The following permissions are required to execute jobs:

  • run.services.create to create jobs and run.services.update to update jobs
  • run.jobs.run to execute jobs
  • run.jobs.get and run.operations.get to read the status of the job
  • artifactregistry.repositories.downloadArtifacts on the repository container the container images of the service

You might also be able to get these permissions with custom roles or other predefined roles.

If your Cloud Run resource interfaces with Cloud Client Libraries, you must grant IAM roles to the service identity, as required by the Cloud Client Libraries.

To grant the Cloud Run deployer account access, see the following instructions:

Console UI

To grant access on the Cloud Run resource:

  1. Go to the Cloud Run page in the Google Cloud console:

    Go to Cloud Run

  2. Select Services or Jobs.

  3. Click the checkbox at the left of the service or job you want to add principals to.

  4. In the information pane in the top right corner click the Permissions tab. If the information pane isn't visible, you may need to click Show Info Panel, then click Permissions.

  5. Click Add principal.

  6. In the New principals field, enter one or more identities that need access to your job.

  7. From the Role drop-down menu, select a role or roles. The roles you select appear in the pane with a short description of the permissions they grant.

  8. Click Save.

To grant access on the Artifact Registry repository:

  1. Go to the Artifact Registry page in the Google Cloud console:

    Go to Artifact Registry

  2. Click the checkbox at the left of the repository you want to add principals to.

  3. In the information pane in the top right corner click the Permissions tab. If the information pane isn't visible, you may need to click Show Info Panel, then click Permissions.

  4. Click Add principal.

  5. In the New principals field, enter one or more identities that need access this repository.

  6. From the Role drop-down menu, select Artifact Registry Reader.

  7. Click Save.

To grant access on the service identity resource:

  1. Go to the Service accounts page of the Google Cloud console:

    Go to Service accounts

  2. Select the service account email address you are using as the service identity, either:

    • The Compute Engine default service account: PROJECT_NUMBER-compute@developer.gserviceaccount.com
    • A service account that was manually created: SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com

  3. Click the Permissions tab.

  4. Click the Grant access button.

  5. Enter the principal (e.g. user or group email) that matches the principal you're granting the Admin or Developer role to.

  6. In the Select a role drop-down, select the Service Accounts > Service Account User role.

  7. Click Save.

gcloud

To grant access on the Cloud Run resource, use the gcloud run services add-iam-policy-binding or the gcloud run jobs add-iam-policy-binding command, replacing the highlighted variables with the appropriate values:

 gcloud run CLOUD_RUN_RESOURCE_TYPE NAME add-iam-policy-binding \
  --member="PRINCIPAL" \
  --role="ROLE"

Replace:

  • CLOUD_RUN_RESOURCE_TYPE with the Cloud Run resource type, such as services or jobs.
  • NAME with the name of the Cloud Run resource.

  • PRINCIPAL with the deployer account you are adding the binding for, using the format user|group|serviceAccount:email or domain:domain. For example:

    • user:test-user@gmail.com
    • group:admins@example.com
    • serviceAccount:test123@example.domain.com
    • domain:example.domain.com

  • ROLE with the role name to assign to the deployer account. For example, roles/run.developer.

    To grant access on the Artifact Registry repository, use the gcloud artifacts repositories add-iam-policy-binding command, replacing the highlighted variables with the appropriate values:

 gcloud artifacts repositories add-iam-policy-binding REPOSITORY \
  --location="LOCATION" \
  --member="PRINCIPAL" \
  --role="roles/artifactregistry.reader"

Replace:

  • REPOSITORY with the ID of the repository.
  • LOCATION with the location of the repository.
  • PRINCIPAL with the deployer account you are adding the binding for, using the format user|group|serviceAccount:email or domain:domain.

To grant access on the service identity resource, use the gcloud iam service-accounts add-iam-policy-binding command, replacing the highlighted variables with the appropriate values:

 gcloud iam service-accounts add-iam-policy-binding \
  SERVICE_ACCOUNT_EMAIL \
  --member="PRINCIPAL" \
  --role="roles/iam.serviceAccountUser"

Replace:

  • SERVICE_ACCOUNT_EMAIL with the service account email address you are using as the service identity, such as:

    • The Compute Engine default service account: PROJECT_NUMBER-compute@developer.gserviceaccount.com
    • A service account that was manually created: SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com

  • PRINCIPAL with the principal you are adding the binding for, using the format user|group|serviceAccount:email or domain:domain. For example:

    • user:test-user@gmail.com
    • group:admins@example.com
    • serviceAccount:test123@example.domain.com
    • domain:example.domain.com

In addition to the deployer account needing these permissions, the Cloud Run service agent must have permissions to access the deployed container. By default, Google grants the Cloud Run Service Agent role to the Cloud Run service agent automatically.

Optional permissions for Cloud Run users

The following optional permissions can be considered when configuring accounts with minimal permission set:

  • monitoring.timeSeries.list on the project level. Typically assigned through the roles/monitoring.viewer role. It allows user to access metrics generated by their service. For more information, go to the Stackdriver documentation for Access Control.
  • logging.logEntries.list on the project level. Typically assigned through the roles/logging.viewer role. It allows user to access logs generated by their service. For more information, go to the Access Control guide in the Stackdriver Logging documentation.