A Cloud Run service or revision has a service identity that is usedas the authenticated account for accessing Google Cloud APIs from yourCloud Run instance container. To learn more about service identity,see theIntroduction to service identityguide.

How service identity is used

In Cloud Run, the service identity is a service account that isboth a resource and a principal.

• Service identity as a resource: To attach a service account as theservice identity, thedeployer accountmust have access on the service identity resource. Certain operations, likecreating or updating a service or revision, require the deployer account tohave permissions on the service identity resource.
• Service identity as a principal: To access Google Cloud APIsfrom a Cloud Run service or revision, you must grant theservice identity the required roles or permissions for the operations you wantyour service or revision to perform.

The next section covers the required roles for granting the deployer accountaccess on the service identity resource and granting the roles or permissionsthat the service account principal needs.

Required roles

You or your administrator must grant IAM roles and permissionsfor the deployer account and the service identity.

Get recommendations to create dedicated service accounts

When you create a new service account from the Google Cloud console, the optionalstep "Grant this service account access to the project" is for any additionalaccess required. For example, one Cloud Run service might invokeanotherprivate Cloud Run service,or it mightaccess a Cloud SQL database, bothwhich require specific IAM roles. Refer to the documentation onmanaging accessfor more information.

TheRecommender service also automaticallysupplies recommendations to create a dedicated service accounts with the minimalrequired set of permissions.

Configure service identity

If you haven't already created a service account, you can either create auser-managed service account inIAM, or inCloud Run.

To configure service identity, use either the Google Cloud console,the gcloud CLI, the API (YAML) when youcreate a new service ordeploy a new revision, or Terraform:

gcloudrunservicesupdateSERVICE--service-accountSERVICE_ACCOUNT

gcloudrundeploy--imageIMAGE_URL--service-accountSERVICE_ACCOUNT

resource"google_service_account""cloudrun_service_identity"{account_id="my-service-account"}

resource"google_cloud_run_v2_service""default"{name="id-service"location="us-central1"deletion_protection=false # set to "true" in productiontemplate{containers{image="us-docker.pkg.dev/cloudrun/container/hello"}service_account=google_service_account.cloudrun_service_identity.email}}

Use service accounts in other projects

If you configure a service account from a different Google Cloud projectthan the Cloud Run resource, do the following:

1. You or your administrator must grant theService Account User role (roles/iam.serviceAccountUser) on theservice account that you use as the service identity.

   Console

   1. Go to theService accounts page of the Google Cloud console:

      Go to Service accounts

   2. Select the service account email address you are using as the serviceidentity.

   3. Click thePrincipals with access tab.

   4. Click theperson_addGrant accessbutton.

   5. Enter the deployer account email address that matches the principalyou're granting the Admin or Developer role to.

   6. In theSelect a role drop-down, select theService Accounts >Service Account User role.

   7. ClickSave.

   gcloud

   Use thegcloud iam service-accounts add-iam-policy-binding command,replacing the highlighted variables with the appropriate values:

   gcloudiamservice-accountsadd-iam-policy-binding\SERVICE_ACCOUNT_NAME@SERVICE_ACCOUNT_PROJECT_ID.iam.gserviceaccount.com\--member="PRINCIPAL"\--role="roles/iam.serviceAccountUser"

   Replace the following:

   • SERVICE_ACCOUNT_NAME: the name of theservice account that you are attaching the Cloud Runresource to
   • SERVICE_ACCOUNT_PROJECT_ID: the project ID where theservice account is located

   • PRINCIPAL: the deployer account you are adding thebinding for, using the formatuser|group|serviceAccount:emailordomain:domain—for example:

     • user:test-user@gmail.com
     • group:admins@example.com
     • serviceAccount:test123@example.domain.com
     • domain:example.domain.com

2. You or your administrator must grant the Cloud Run resource'sservice agent the Service Account Token Creator role(roles/iam.serviceAccountTokenCreator) on the service accountyou use as the service identity. The service agent follows the format ofservice-PROJECT_NUMBER@serverless-robot-prod.iam.gserviceaccount.com.

   Console

   1. Go to theService accounts page of the Google Cloud console:

      Go to Service accounts

   2. Select the service account email address you are using as the serviceidentity.

   3. Click thePermissions tab.

   4. Click theperson_addGrant accessbutton.

   5. Enter the service agent email address. For example:service-PROJECT_NUMBER@serverless-robot-prod.iam.gserviceaccount.com.

   6. In theSelect a role drop-down, select theService Accounts >Service Account Token Creator role.

   7. ClickSave.

   gcloud

   Use thegcloud iam service-accounts add-iam-policy-binding command:

   gcloudiamservice-accountsadd-iam-policy-binding\SERVICE_ACCOUNT_NAME@SERVICE_ACCOUNT_PROJECT_ID.iam.gserviceaccount.com\--member="serviceAccount:service-CLOUD_RUN_RESOURCE_PROJECT_NUMBER@serverless-robot-prod.iam.gserviceaccount.com"\--role="roles/iam.serviceAccountTokenCreator"

   Replace the following:

   • SERVICE_ACCOUNT_NAME: the name of theservice account that you are attaching the Cloud Runresource to
   • SERVICE_ACCOUNT_PROJECT_ID: the project ID where theservice account is located
   • CLOUD_RUN_RESOURCE_PROJECT_NUMBER:the project number where the Cloud Run is located

   The command prints the updated allow policy for the user-managed serviceaccount.

3. The project containing this service account requires the org-policyiam.disableCrossProjectServiceAccountUsage to be set tofalse or unenforced at the folder level or inherited from project-levelsettings. By default, this is set totrue.

   Console

   1. Go to theOrganization policies page in the Google Cloud console:

      Go to Organization policies

   2. From the project picker, select the organization and project forwhich you want to disable cross-project service account usage for.

   3. Select thedisable cross-project service account usage policy.

   4. ClickManage policy.

   5. UnderPolicy source, selectOverride parent's policy.

   6. ClickAdd a rule.

   7. UnderEnforcement, selectOff.

   8. To enforce the policy, clickSet policy.

   gcloud

   In the project that has the service account, ensure that theiam.disableCrossProjectServiceAccountUsage organization policy constraintis not enforced. This constraint is enforced by default.

   To disable this organization policy constraint, run:

   gcloudresource-managerorg-policiesdisable-enforceiam.disableCrossProjectServiceAccountUsage--project=SERVICE_ACCOUNT_PROJECT_ID

   ReplaceSERVICE_ACCOUNT_PROJECT_ID with the project ID thatcontains the service account.

You can apply role memberships directly to the service account resource orinherit from higher levels in theresource hierarchy.

What's next

• For more information about service accounts, see theIAM service accountanduser-managed service account guides.
• If your Cloud Run service, job, or worker pool accesses Google APIs orGoogle Cloud services, you must configure your service account as theservice identity.Learn more.