Perhatikan bahwa akun layanan Cloud Build lama secara otomatis diberikan peran Akun Layanan Cloud Build untuk project. Akun layanan default Compute Engine tidak menyertakan peran ini. Anda dapat memberikan lebih banyak izin ke akun layanan apa pun yang Anda gunakan.
Memberikan peran ke akun layanan Cloud Build default menggunakan halaman Setelan
Anda dapat memberikan peran IAM tertentu yang umum digunakan ke akun layanan Cloud Build default menggunakan halaman Setelan Cloud Build di konsol Google Cloud :
Gunakan menu drop-down untuk memilih akun layanan yang ingin Anda perbarui.
Tetapkan status peran yang ingin Anda tambahkan ke Aktifkan.
Memberikan peran ke akun layanan Cloud Build default menggunakan halaman IAM
Jika peran yang ingin Anda berikan tidak tercantum di halaman Setelan Cloud Build di konsol Google Cloud , gunakan halaman IAM untuk memberikan peran tersebut:
Di atas tabel izin, pilih kotak centang
Sertakan pemberian peran yang diberikan Google.
Anda akan melihat lebih banyak baris muncul di tabel izin.
Di tabel izin, temukan akun layanan Cloud Build default Anda.
Klik ikon pensil.
Temukan peran yang ingin dicabut, lalu klik ikon tempat sampah di samping
peran tersebut.
Memberikan peran ke agen layanan Cloud Build
Selain akun layanan default Cloud Build, Cloud Build memiliki agen layanan Cloud Build yang memungkinkan layanan Google Cloud lain mengakses resource Anda. Setelah Anda mengaktifkan Cloud Build API, agen layanan akan otomatis dibuat di projectGoogle Cloud . Agen layanan memiliki format berikut, dengan
PROJECT_NUMBER adalah nomor project Anda.
Anda dapat melihat agen layanan untuk project dengan membuka halaman IAM di halaman Google Cloud console dan mencentang kotak Show google managed service accounts.
Jika tidak sengaja mencabut peran agen layanan Cloud Build di project, Anda dapat memberikannya secara manual menggunakan langkah-langkah berikut:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[[["\u003cp\u003eThis document explains how to manage permissions for the default Cloud Build service account, including granting and revoking roles.\u003c/p\u003e\n"],["\u003cp\u003eYou can use either the Cloud Build Settings page or the IAM page in the Google Cloud console to grant roles to the default Cloud Build service account.\u003c/p\u003e\n"],["\u003cp\u003eTo revoke a role from the default Cloud Build service account, you must use the IAM page in the Google Cloud console.\u003c/p\u003e\n"],["\u003cp\u003eThe Cloud Build service agent, which allows other Google Cloud services to access your resources, is automatically created when you enable the Cloud Build API.\u003c/p\u003e\n"],["\u003cp\u003eIf you accidentally revoke the Cloud Build service agent's role, you can manually grant it back by using the IAM page or by using the \u003ccode\u003egcloud\u003c/code\u003e command-line tool.\u003c/p\u003e\n"]]],[],null,["# Configure access for the default Cloud Build service account\n\n| **Note:** We have introduced changes to the default service account used to run builds. As a best practice, we recommend that you [specify your own service\n| account](/build/docs/securing-builds/configure-user-specified-service-accounts) to run your builds. For more information see [Cloud Build default\n| service account change](/build/docs/cloud-build-service-account-updates).\n\nThis page explains how to grant permissions to and revoke permissions from the\n[default Cloud Build service account](/build/docs/cloud-build-service-account).\n\nNote that the legacy Cloud Build service account is automatically\ngranted the Cloud Build Service Account role for the project. The\n[Compute Engine default service account](/compute/docs/access/service-accounts#default_service_account)\ndoesn't include this role. You can grant more permissions to whatever service\naccount you're using.\n\nBefore you begin\n----------------\n\n- Understand [Cloud Build roles and permissions](/build/docs/iam-roles-permissions).\n- Read [Default Cloud Build service account](/build/docs/cloud-build-service-account).\n\nGrant a role to the default Cloud Build service account using the Settings page\n-------------------------------------------------------------------------------\n\nYou can grant certain commonly used IAM roles to the default\nCloud Build service account using the Cloud Build Settings page in the Google Cloud console:\n\n1. Open the Cloud Build Settings page:\n\n [Open the Cloud Build Settings page](https://console.cloud.google.com/cloud-build/settings)\n\n You'll see the **Service account permissions** page:\n\n2. Use the drop-down menu to select the service account you want to update.\n\n3. Set the status of the role you want to add to **Enable**.\n\nGrant a role to the default Cloud Build service account using the IAM page\n--------------------------------------------------------------------------\n\nIf the role you want to grant is not listed in the Cloud Build Settings page\nin the Google Cloud console, use the IAM page to grant the role:\n\n1. Open the IAM page:\n\n [Open the IAM page](https://console.cloud.google.com/iam-admin/iam)\n2. Select your Google Cloud project.\n\n3. Above the permissions table, select the\n **Include Google-provided role grants** checkbox.\n\n You'll see that more rows appear in the permissions table.\n4. In the permissions table, find your default Cloud Build service\n account.\n\n5. Click the pencil icon.\n\n6. Select the role you want to grant to the Cloud Build service\n account.\n\n7. Click **Save**.\n\nRevoke a role from the Cloud Build service account\n--------------------------------------------------\n\n1. Open the IAM page:\n\n [Open the IAM page](https://console.cloud.google.com/iam-admin/iam)\n2. Select your Google Cloud project.\n\n3. Above the permissions table, select the\n **Include Google-provided role grants** checkbox.\n\n You'll see that more rows appear in the permissions table.\n4. In the permissions table, find your default Cloud Build service\n account.\n\n5. Click the pencil icon.\n\n6. Locate the role you want to revoke and click the delete trash can next to the\n role.\n\nGrant a role to the Cloud Build service agent\n---------------------------------------------\n\nIn addition to the Cloud Build default service account,\nCloud Build has a *Cloud Build service agent* that allows\nother Google Cloud services to access your resources. After you enable the\nCloud Build API, the service agent is automatically created in the\nGoogle Cloud project. The service agent has the following format, where\n\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e is your project number. \n\n service-\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003ePROJECT_NUMBER\u003c/span\u003e\u003c/var\u003e@gcp-sa-cloudbuild.iam.gserviceaccount.com\n\nYou can view the service agent for a project by going to the\n[IAM page in the Google Cloud console](https://console.cloud.google.com/iam-admin/iam)\npage and selecting the **Show google managed service accounts** checkbox.\n\nIf you've accidentally revoked the Cloud Build service agent's role\non your project, you can grant it manually using the following steps: \n\n### Console\n\n1. Open the **IAM** page in the Google Cloud console:\n\n [Open the IAM page](https://console.cloud.google.com/iam-admin/iam)\n2. Click **Grant access**.\n\n3. Add the following principal, where \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e\n is your project number:\n\n service-\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e@gcp-sa-cloudbuild.iam.gserviceaccount.com\n\n4. Select **Service Agents** \\\u003e **Cloud Build Service Agent** as your role.\n\n5. Click **Save**.\n\n### gcloud\n\nGrant `roles/cloudbuild.serviceAgent` IAM role to the\nCloud Build service agent: \n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member=\"serviceAccount:service-\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e@gcp-sa-cloudbuild.iam.gserviceaccount.com\" \\\n --role=\"roles/cloudbuild.serviceAgent\"\n\nReplace the placeholder values in the command with the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: The project ID\n- \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: The project number\n\nWhat's next\n-----------\n\n- Learn about [user-specified service accounts](/build/docs/securing-builds/configure-user-specified-service-accounts).\n- Learn about [service accounts in depth](/iam/docs/understanding-service-accounts).\n- Learn about [configuring access to Cloud Build resources](/build/docs/securing-builds/configure-access-to-resources).\n- Learn about [the permissions required to view build logs](/build/docs/securing-builds/store-view-build-logs)."]]
