Cloud Run IAM roles

Curated roles

The following table describes Identity and Access Management (IAM) roles that are associated with Cloud Run, and lists the permissions that are contained in each role.

Important: The roles in the table and other references to IAM roles on this page that contain run.* do not apply to Cloud Run for Anthos, which require GKE permissions along with Kubernetes role based access control (RBAC).

Roles can be granted to users on an entire project or on individual services. Read Managing access using IAM to learn more.

Roles only apply to Cloud Run services, they do not apply to Cloud Run domain mappings. The Project > Editor role is needed to create or update domain mappings.

Role	Description	Permissions
roles/run.admin	Can create, update, and delete services. Can get and set IAM policies. Requires additional configuration in order to deploy services.	run.services.get run.services.list run.services.create run.services.update run.services.delete run.services.getIamPolicy run.services.setIamPolicy run.routes.get run.routes.list run.routes.invoke run.configurations.get run.configurations.list run.revisions.get run.revisions.list run.revisions.delete run.locations.get run.locations.list
roles/run.developer	Can create, update, and delete services. Can get but not set IAM policies.	run.services.get run.services.list run.services.create run.services.update run.services.delete run.services.getIamPolicy run.routes.get run.routes.list run.routes.invoke run.configurations.get run.configurations.list run.revisions.get run.revisions.list run.revisions.delete run.locations.get run.locations.list
roles/run.viewer	Can view services. Can get IAM policies.	run.services.get run.services.list run.services.getIamPolicy run.routes.get run.routes.list run.configurations.get run.configurations.list run.revisions.get run.revisions.list run.locations.get run.locations.list
roles/run.invoker	Can invoke services.	run.routes.invoke

For a reference describing the IAM permissions contained in each IAM role, refer to Cloud Run IAM Permissions.

Custom roles

For developers that want to define their own roles containing bundles of permissions that they specify, IAM offers custom roles.

If the role contains permissions that let a developer deploy services, then you must perform the additional configuration below.

Deployment permissions

A user needs the following permissions to deploy new Cloud Run services or revisions:

• run.services.create and run.services.update on the project level are required. run.services.get is not strictly required, but is recommended in order to read the status of the created service. Typically assigned through the roles/run.admin role. It can be changed in the project permissions admin page.
• iam.serviceAccounts.actAs for the Cloud Run runtime service account. By default, this is [e-mail]. The permission is typically assigned through the roles/iam.serviceAccountUser role.

To assign the IAM Service Account User role on the Cloud Run runtime service account:

Console UI

1. Go to the Service accounts page of the Google Cloud Console:

   Go to Service accounts

2. Select the Runtime Service Account ([e-mail]) from the table.

3. Click Show Info Panel in the top right corner to show the Permissions tab.

4. Click the Add member button.

5. Enter the member (e.g. user or group email) that matches the member you're granting the Admin or Developer role to.

6. In the Select a role dropdown, select the Service Accounts > Service Account User role.

7. Click Save.

gcloud

1. Use the gcloud iam service-accounts add-iam-policy-binding command, replacing the highlighted variables with appropriate values:

gcloud iam service-accounts add-iam-policy-binding \
  [e-mail] \
  --member="MEMBER" \
  --role="roles/iam.serviceAccountUser"

Caution: Assigning the IAM Service Account User role indirectly grants the role associated with the runtime service account to the user. For example: a user has the Cloud Run Admin role, and the user is also assigned the role of IAM Service Account User on a runtime service account. If the runtime service account has the Editor role, the user can then "act as" an Editor. We recommend configuring the runtime service account for least privilege to minimize the impact of these role assignments.

In addition to the developer needing these permissions, the Cloud Run service agent needs to be able to access the deployed container, which is the case by default.

Optional permissions for Cloud Run users

The following optional permissions can be considered when configuring accounts with minimal permission set:

• monitoring.timeSeries.list on the project level. Typically assigned through the roles/monitoring.viewer role. It allows user to access metrics generated by their service. For more information, go to the Stackdriver documentation for Access Control.
• logging.logEntries.list on the project level. Typically assigned through the roles/logging.viewer role. It allows user to access logs generated by their service. For more information, go to the Access Control guide in the Stackdriver Logging documentation.