Note that the legacy Cloud Build service account is automatically
granted the Cloud Build Service Account role for the project. The
Compute Engine default service account
doesn't include this role. You can grant more permissions to whatever service
account you're using.
Grant a role to the default Cloud Build service account using the Settings page
You can grant certain commonly used IAM roles to the default
Cloud Build service account using the Cloud Build Settings page in the Google Cloud console:
Above the permissions table, select the
Include Google-provided role grants checkbox.
You'll see that more rows appear in the permissions table.
In the permissions table, find your default Cloud Build service
account.
Click the pencil icon.
Locate the role you want to revoke and click the delete trash can next to the
role.
Grant a role to the Cloud Build service agent
In addition to the Cloud Build default service account,
Cloud Build has a Cloud Build service agent that allows
other Google Cloud services to access your resources. After you enable the
Cloud Build API, the service agent is automatically created in the
Google Cloud project. The service agent has the following format, where
PROJECT_NUMBER is your project number.
You can view the service agent for a project by going to the
IAM page in the Google Cloud console
page and selecting the Show google managed service accounts checkbox.
If you've accidentally revoked the Cloud Build service agent's role
on your project, you can grant it manually using the following steps:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[[["\u003cp\u003eThis document explains how to manage permissions for the default Cloud Build service account, including granting and revoking roles.\u003c/p\u003e\n"],["\u003cp\u003eYou can use either the Cloud Build Settings page or the IAM page in the Google Cloud console to grant roles to the default Cloud Build service account.\u003c/p\u003e\n"],["\u003cp\u003eTo revoke a role from the default Cloud Build service account, you must use the IAM page in the Google Cloud console.\u003c/p\u003e\n"],["\u003cp\u003eThe Cloud Build service agent, which allows other Google Cloud services to access your resources, is automatically created when you enable the Cloud Build API.\u003c/p\u003e\n"],["\u003cp\u003eIf you accidentally revoke the Cloud Build service agent's role, you can manually grant it back by using the IAM page or by using the \u003ccode\u003egcloud\u003c/code\u003e command-line tool.\u003c/p\u003e\n"]]],[],null,["# Configure access for the default Cloud Build service account\n\n| **Note:** We have introduced changes to the default service account used to run builds. As a best practice, we recommend that you [specify your own service\n| account](/build/docs/securing-builds/configure-user-specified-service-accounts) to run your builds. For more information see [Cloud Build default\n| service account change](/build/docs/cloud-build-service-account-updates).\n\nThis page explains how to grant permissions to and revoke permissions from the\n[default Cloud Build service account](/build/docs/cloud-build-service-account).\n\nNote that the legacy Cloud Build service account is automatically\ngranted the Cloud Build Service Account role for the project. The\n[Compute Engine default service account](/compute/docs/access/service-accounts#default_service_account)\ndoesn't include this role. You can grant more permissions to whatever service\naccount you're using.\n\nBefore you begin\n----------------\n\n- Understand [Cloud Build roles and permissions](/build/docs/iam-roles-permissions).\n- Read [Default Cloud Build service account](/build/docs/cloud-build-service-account).\n\nGrant a role to the default Cloud Build service account using the Settings page\n-------------------------------------------------------------------------------\n\nYou can grant certain commonly used IAM roles to the default\nCloud Build service account using the Cloud Build Settings page in the Google Cloud console:\n\n1. Open the Cloud Build Settings page:\n\n [Open the Cloud Build Settings page](https://console.cloud.google.com/cloud-build/settings)\n\n You'll see the **Service account permissions** page:\n\n2. Use the drop-down menu to select the service account you want to update.\n\n3. Set the status of the role you want to add to **Enable**.\n\nGrant a role to the default Cloud Build service account using the IAM page\n--------------------------------------------------------------------------\n\nIf the role you want to grant is not listed in the Cloud Build Settings page\nin the Google Cloud console, use the IAM page to grant the role:\n\n1. Open the IAM page:\n\n [Open the IAM page](https://console.cloud.google.com/iam-admin/iam)\n2. Select your Google Cloud project.\n\n3. Above the permissions table, select the\n **Include Google-provided role grants** checkbox.\n\n You'll see that more rows appear in the permissions table.\n4. In the permissions table, find your default Cloud Build service\n account.\n\n5. Click the pencil icon.\n\n6. Select the role you want to grant to the Cloud Build service\n account.\n\n7. Click **Save**.\n\nRevoke a role from the Cloud Build service account\n--------------------------------------------------\n\n1. Open the IAM page:\n\n [Open the IAM page](https://console.cloud.google.com/iam-admin/iam)\n2. Select your Google Cloud project.\n\n3. Above the permissions table, select the\n **Include Google-provided role grants** checkbox.\n\n You'll see that more rows appear in the permissions table.\n4. In the permissions table, find your default Cloud Build service\n account.\n\n5. Click the pencil icon.\n\n6. Locate the role you want to revoke and click the delete trash can next to the\n role.\n\nGrant a role to the Cloud Build service agent\n---------------------------------------------\n\nIn addition to the Cloud Build default service account,\nCloud Build has a *Cloud Build service agent* that allows\nother Google Cloud services to access your resources. After you enable the\nCloud Build API, the service agent is automatically created in the\nGoogle Cloud project. The service agent has the following format, where\n\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e is your project number. \n\n service-\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003ePROJECT_NUMBER\u003c/span\u003e\u003c/var\u003e@gcp-sa-cloudbuild.iam.gserviceaccount.com\n\nYou can view the service agent for a project by going to the\n[IAM page in the Google Cloud console](https://console.cloud.google.com/iam-admin/iam)\npage and selecting the **Show google managed service accounts** checkbox.\n\nIf you've accidentally revoked the Cloud Build service agent's role\non your project, you can grant it manually using the following steps: \n\n### Console\n\n1. Open the **IAM** page in the Google Cloud console:\n\n [Open the IAM page](https://console.cloud.google.com/iam-admin/iam)\n2. Click **Grant access**.\n\n3. Add the following principal, where \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e\n is your project number:\n\n service-\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e@gcp-sa-cloudbuild.iam.gserviceaccount.com\n\n4. Select **Service Agents** \\\u003e **Cloud Build Service Agent** as your role.\n\n5. Click **Save**.\n\n### gcloud\n\nGrant `roles/cloudbuild.serviceAgent` IAM role to the\nCloud Build service agent: \n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member=\"serviceAccount:service-\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e@gcp-sa-cloudbuild.iam.gserviceaccount.com\" \\\n --role=\"roles/cloudbuild.serviceAgent\"\n\nReplace the placeholder values in the command with the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: The project ID\n- \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: The project number\n\nWhat's next\n-----------\n\n- Learn about [user-specified service accounts](/build/docs/securing-builds/configure-user-specified-service-accounts).\n- Learn about [service accounts in depth](/iam/docs/understanding-service-accounts).\n- Learn about [configuring access to Cloud Build resources](/build/docs/securing-builds/configure-access-to-resources).\n- Learn about [the permissions required to view build logs](/build/docs/securing-builds/store-view-build-logs)."]]