Console

1. Go to theIAM & Admin page for theproject or organization.

   Go to IAM & Admin

2. Locate your account and clickeditEdit.

3. In theSelect a role list, select the following roles:

   • Cloud Storage>Storage Admin
   • Project>Viewer
   • Resource Manager>Project IAM Admin
   • Cloud Build>Cloud Build Editor

4. Save your changes.

gcloud

In the following steps, you use thegcloud projects add-iam-policy-bindingcommand to grant therequired roles at the project level.

1. Grant theroles/storage.admin role:

   gcloud projects add-iam-policy-bindingPROJECT_ID \  --member='MEMBER' \  --role='roles/storage.admin'

   Replace the following:

   • PROJECT_ID: theGoogle Cloud project IDfor your project
   • MEMBER: the account that runs theimport and export commands—for example,user:export-user@gmail.com

2. Grant theroles/viewer role:

   gcloud projects add-iam-policy-bindingPROJECT_ID \  --member='MEMBER' \  --role='roles/viewer'

3. Grant theroles/resourcemanager.projectIamAdmin role:

   gcloud projects add-iam-policy-bindingPROJECT_ID \  --member='MEMBER' \  --role='roles/resourcemanager.projectIamAdmin'

4. Grant theroles/cloudbuild.builds.editor role:

   gcloud projects add-iam-policy-bindingPROJECT_ID \  --member='MEMBER' \  --role='roles/cloudbuild.builds.editor'

REST

1. Read the existing policy with the resource'sgetIamPolicy method. Forprojects, use theprojects.getIamPolicy method.

   POST https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:getIamPolicy

   ReplacePROJECT_ID with the projectID—for example,my-project-1.

2. To grant the required roles to your account, edit the policy witha text editor.

   For example, to grant the required role to your accountuser:export-user@gmail.com, add the following binding to the policy:

   {   {     "role":"roles/storage.admin",     "member":[       "user:export-user@gmail.com"     ]   }   {     "roles":"roles/viewer",     "member":[       "user:export-user@gmail.com"     ]   }   {     "roles":"roles/resourcemanager.projectIamAdmin",     "member":[       "user:export-user@gmail.com"     ]   }   {     "roles":"roles/cloudbuild.builds.editor",     "member":[       "user:export-user@gmail.com"     ]   }}

3. To write the updated policy, use thesetIamPolicy method.

   For example, to seta policy at the project level, use theproject.setIamPolicymethod. Inthe body of the request, provide the updated IAM policyfrom the previous step.

   POST https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:setIamPolicy

Console

1. After you enable the Cloud Build API, go to theIAM & Adminpage for the project or organization.

   Go to IAM & Admin

2. Locate the Cloud Build service account and clickeditEdit.

3. If the required roles are not listed, do the following:

   1. ClickaddAdd another role.

   2. In theSelect a role list, select the required roles that you wantto add:

      • Service Account>Service Account Token Creator
      • Service Account>Service Account User

      • Compute Engine>Compute Admin

        Alternatively, you can select theCustom role. SeePermissions required for the custom role earlierin this document.

   3. ClickSave to save the changes.

4. Optional: If you're importing or exporting images that use Shared VPC, select the Compute Network User role in the Shared VPC project:

   1. From the project selector at the top of the console, select theShared VPC host project.
   2. On theIAM & Admin page, clickperson_addGrant access.
   3. In theNew principals field, enter the email address of the Cloud Build service account:

      PROJECT_NUMBER@cloudbuild.gserviceaccount.com'

      ReplacePROJECT_NUMBER with the unique number of the project where you import or export images.
   4. In theSelect a role list, selectCompute Engine>Compute Network User role.
   5. ClickSave to save the changes.

gcloud

In the following steps, you use thegcloud projects add-iam-policy-bindingcommand to grant therequired roles at the project level.

1. Grant theroles/compute.admin role to the Cloud Build serviceaccount.To avoid granting theroles/compute.admin role, you can create a customrole with the required permissions and then grant that role to theCloud Build service account. SeePermissions required for the custom role earlier in this document.

   gcloud projects add-iam-policy-bindingPROJECT_ID \   --member='serviceAccount:PROJECT_NUMBER@cloudbuild.gserviceaccount.com' \   --role='roles/compute.admin'

   Replace the following:

   • PROJECT_ID: theGoogle Cloud project ID for your project
   • PROJECT_NUMBER: theGoogle Cloud project number for your project

2. Grant theroles/iam.serviceAccountUser role:

   gcloud projects add-iam-policy-bindingPROJECT_ID \   --member='serviceAccount:PROJECT_NUMBER@cloudbuild.gserviceaccount.com' \   --role='roles/iam.serviceAccountUser'

3. Grant theroles/iam.serviceAccountTokenCreator role:

   gcloud projects add-iam-policy-bindingPROJECT_ID \   --member='serviceAccount:PROJECT_NUMBER@cloudbuild.gserviceaccount.com' \   --role='roles/iam.serviceAccountTokenCreator'

4. Optional: If you're exporting or importingimages that use Shared VPC, grant theroles/compute.networkUser role:

   gcloud projects add-iam-policy-bindingHOST_PROJECT_ID \   --member='serviceAccount:PROJECT_NUMBER@cloudbuild.gserviceaccount.com' \   --role='roles/compute.networkUser'

   Replace the following:

   • HOST_PROJECT_ID: the ID of the host projectwhere the Shared VPC is located
   • PROJECT_NUMBER: the unique number of the projectwhere you import or export images

REST

1. Read the existing policy with the resource'sgetIamPolicy method. Forprojects, use theprojects.getIamPolicy method.

   POST https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:getIamPolicy

   ReplacePROJECT_ID with the projectID—for example,my-project-1.

2. To grant the required roles to your account, edit the policy witha text editor.

   For example, to grant the required roles toserviceAccount:12345@cloudbuild.gserviceaccount.com, add the followingbinding to the policy:

   {   {     "role":"roles/compute.admin",     "member":[       "serviceAccount:12345@cloudbuild.gserviceaccount.com"     ]   }   {     "roles":"roles/iam.serviceAccountUser",     "member":[       "serviceAccount:12345@cloudbuild.gserviceaccount.com"     ]   }  {     "roles":"roles/iam.serviceAccountTokenCreator",     "member":[       "serviceAccount:12345@cloudbuild.gserviceaccount.com"     ]   }}

   To avoid granting theroles/compute.admin role, you can create acustom role with the required permissions and then grant that role tothe Cloud Build service account. SeePermissions required for the custom role earlier in this document.

3. Optional: If you're exporting or importing images that useShared VPC, grant theroles/compute.networkUser role in theShared VPC project.

   POST https://cloudresourcemanager.googleapis.com/v1/projects/HOST_PROJECT_ID:getIamPolicy

   ReplaceHOST_PROJECT_ID with the ID of theShared VPC project.

   Add the following IAM binding to theCloud Build service account:

   {   {     "roles":"roles/compute.networkUser",     "member":[       "serviceAccount:12345@cloudbuild.gserviceaccount.com"     ]   }}

4. To write the updated policy, use thesetIamPolicy method.

   For example, to seta policy at the project level, use theproject.setIamPolicymethod. Inthe body of the request, provide the updated IAM policyfrom the previous step.

   POST https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:setIamPolicy

Console

1. Go to theIAM & Admin page for theproject or organization.

   Go to IAM & Admin

2. Locate the Compute Engine service account and clickeditEdit.

3. In theSelect a role list, select the following roles:

   • Compute Engine>Compute Storage Admin
   • Cloud Storage>Storage Object Viewer
   • Cloud Storage>Storage Object Admin

4. Save your changes.

gcloud

In the following steps, you use thegcloud projects add-iam-policy-bindingcommand to grant therequired roles at the project level.

1. Grant theroles/compute.storageAdmin role:

   gcloud projects add-iam-policy-bindingPROJECT_ID \  --member='serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com' \  --role='roles/compute.storageAdmin'

2. If you're importing an image, grant theroles/storage.objectViewer role:

   gcloud projects add-iam-policy-bindingPROJECT_ID \  --member='serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com' \  --role='roles/storage.objectViewer'

3. If you're exporting an image, grant theroles/storage.objectAdmin role:

   gcloud projects add-iam-policy-bindingPROJECT_ID \  --member='serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com' \  --role='roles/storage.objectAdmin'

REST

1. Read the existing policy with the resource'sgetIamPolicy method. Forprojects, use theprojects.getIamPolicy method.

   POST https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:getIamPolicy

   ReplacePROJECT_ID with the projectID—for example,my-project-1.

2. To grant the required roles to your account, edit the policy witha text editor.

   For example, to grant the required roles toserviceAccount:12345-compute@developer.gserviceaccount.com forimporting an image, add the following binding to the policy:

   {   {     "role":"roles/compute.storageAdmin",     "member":[       "serviceAccount:12345-compute@developer.gserviceaccount.com"     ]   }   {     "roles":"roles/storage.objectViewer",     "member":[       "serviceAccount:12345-compute@developer.gserviceaccount.com"     ]   }}

3. To write the updated policy, use thesetIamPolicy method.

   For example, to seta policy at the project level, use theproject.setIamPolicymethod. Inthe body of the request, provide the updated IAM policyfrom the previous step.

   POST https://cloudresourcemanager.googleapis.com/v1/projects/PROJECT_ID:setIamPolicy