Set build service account (source deploy)

During source deployments, Cloud Run leverages Cloud Buildwhen building and deploying your Cloud Run service.

This page shows how to set auser-specified service accountfor Cloud Build to use when executing builds of the service on your behalf.This guide is relevant for platform developers who are deployingCloud Runservices orfunctions using the Google Cloud CLI and need tocustomize the build service account used by Cloud Build. The build serviceaccount gcloud CLI flag is supported forsource deployments (--source), and notsupported forcontainer image deployments (--image).

Before you begin

  1. Enable the Cloud Build API:

    gcloudservicesenablecloudbuild.googleapis.com

  2. Create a service account, or have anexisting service account, to use as the Cloud Build serviceaccount.

Required roles

You or your administrator must grant the deployer account and theCloud Build service account the following IAM roles.

Click to view required roles for the deployer account

To get the permissions that you need to build and deploy from source, ask your administrator to grant you the following IAM roles:

Click to view required roles for the Cloud Build service account

To allow the Cloud Build service account to perform the build when deploying a function, ask your administrator to grant theCloud Run Builder (roles/run.builder) role to the Cloud Build service account on the project.

Note: If you need to use a service account from a different project, youor your administrator must grant additional access to the service account. SeeCross-project set upfor more details.

For a list of IAM roles and permissions that are associated withCloud Run, seeCloud Run IAM rolesandCloud Run IAM permissions.If your Cloud Run service interfaces withGoogle Cloud APIs, such as Cloud Client Libraries, see theservice identity configuration guide.For more information about granting roles, seedeployment permissionsandmanage access.

Specify a Cloud Build service account

By default, if a Cloud Build service account isn't specified whendeploying aservice orfunction from source,Cloud Build uses thedefault Cloud Build service account.

As a best practice for following the principle of least privilege to improve thesecurity posture of your service, we recommend that you specify your own serviceaccount to run your builds when deploying a service from source.

gcloud

To specify the Cloud Build service account when deploying aservice from source code, use the--build-service-account flag:

gcloudrundeploySERVICE\--source.\--build-service-accountprojects/PROJECT_ID/serviceAccounts/BUILD_SERVICE_ACCOUNT

Replace:

  • SERVICE with name of your Cloud Run service.
  • PROJECT_ID the project ID where the build service account iscreated.
  • BUILD_SERVICE_ACCOUNT with a user-specified service account.

If you are deploying a function, add the--function flag with the functionentry point from your source code.

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-18 UTC.