[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-17。"],[[["\u003cp\u003eCloud Deploy utilizes three main service accounts: the service agent for interacting with your project, the execution service account for render and deploy operations, and the automation service account for performing automations.\u003c/p\u003e\n"],["\u003cp\u003eThe default execution service account is the default Compute Engine service account, but it's best practice to use a different service account, configured per target, to have more granular control over permissions.\u003c/p\u003e\n"],["\u003cp\u003eService accounts used for rendering and deploying need specific permissions, including access to Cloud Storage buckets and necessary runtime-specific permissions for the chosen deployment environment, such as Google Kubernetes Engine or Cloud Run.\u003c/p\u003e\n"],["\u003cp\u003eYou can use service accounts from different projects, but this requires enabling the cross-project service account organization policy and granting specific roles and permissions to both the Cloud Deploy service agent and the Cloud Build service agent.\u003c/p\u003e\n"],["\u003cp\u003eTo call Cloud Deploy to create or promote a release or a rollout, the calling service account must have the \u003ccode\u003eiam.serviceAccount.actAs\u003c/code\u003e permission or the \u003ccode\u003eroles/iam.serviceAccountUser\u003c/code\u003e role to use the service account designated for rendering or deploying.\u003c/p\u003e\n"]]],[],null,["# Cloud Deploy service accounts\n\nThis document describes service accounts that are used to run Cloud Deploy\nand to call Cloud Deploy to run various operations.\n\nCloud Deploy uses the following service accounts:\n\n- The Cloud Deploy [service agent](/iam/docs/service-agents)\n\n Cloud Deploy uses this service account to interact with your\n project. You can't replace this service agent with an alternate service\n account, but you can edit permissions on it, for example when you're using\n resources outside of the project (such as a service account or a private\n Cloud Build worker pool).\n- The Cloud Deploy execution service account\n\n Cloud Deploy uses this service account to execute render and\n deploy operations in Cloud Build. This account needs permissions\n sufficient to read from and write to the Cloud Storage bucket and to\n access deployment targets.\n\n The default service account for execution is the\n [default Compute Engine service account](/deploy/docs/cloud-deploy-service-account#default_service_account).\n You can specify an alternate service account in the\n [target configuration](/deploy/docs/config-files#target_definitions).\n- The Cloud Deploy automation service account\n\n This is the service account Cloud Deploy uses to perform\n [automations](/deploy/docs/automation). This can be the default execution\n service account or another service account. See\n [The automation service account](/deploy/docs/automation-resource#automation_service_account)\n For more information about this service account.\n\nSee [Creating and managing service accounts](/iam/docs/creating-managing-service-accounts)\nfor instructions on how to edit service-account permissions and how to create\nan alternate service account.\n\nCloud Deploy service agent\n--------------------------\n\nThe Cloud Deploy service agent is a service account that\nCloud Deploy uses to interact with other Google Cloud\nservices that Cloud Deploy relies on. These services include\nCloud Build, Pub/Sub, and Cloud Audit Logs.\n\nThe name of this service account follows this pattern:\n\n`service-\u003cproject-number\u003e@gcp-sa-clouddeploy.iam.gserviceaccount.com`\n\nIf this account is removed from your project, you can re-add it:\n\n1. Open the **IAM** page in the Google Cloud console:\n\n \u003cbr /\u003e\n\n [Open the IAM page](https://console.cloud.google.com/iam-admin/iam)\n\n \u003cbr /\u003e\n\n2. Select **Include Google-provided role grants** to display the service agent.\n\n If the service agent is displayed, you can skip the rest of these steps.\n3. If the service agent isn't displayed, click **Grant access**.\n\n4. In the **New principals** field, enter the service agent address, in the\n following format:\n\n 1. `service-\u003cproject-number\u003e@gcp-sa-clouddeploy.iam.gserviceaccount.com`\n5. Click the **Select a role** drop-down list, and select **Cloud Deploy Service Agent**.\n\n6. Click **Save**.\n\nCloud Deploy execution service account\n--------------------------------------\n\nBy default, Cloud Deploy runs using the [default Compute Engine\nservice account](/iam/docs/service-account-types#default).\n\nThe name of this service account follows this pattern:\n\n`[project-number]-compute@developer.gserviceaccount.com`\n\nBecause this service account is used by many products, it may have broad\npermissions. The best practice is to change your [execution environment](/deploy/docs/execution-environment) so\nthat Cloud Deploy runs as a different service account.\nYou can change the execution service account for each\n[target](/deploy/docs/config-files#target_definitions) using\nthe `executionConfigs.privatePool.serviceAccount` property or the\n`executionConfigs.defaultPool.serviceAccount` property in the\n[target definition](/deploy/docs/config-files#target_definitions).\n\nAny service account you set for these properties must have the\n[Cloud Deploy Runner](/deploy/docs/iam-roles-permissions#clouddeploy.jobRunner) role in the\nCloud Deploy project. If the default execution service account doesn't have this\nrole, run the following command: \n\n gcloud projects add-iam-policy-binding \u003cvar label=\"project id\" translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member=serviceAccount:$(gcloud projects describe \u003cvar label=\"project id\" translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --format=\"value(projectNumber)\")-compute@developer.gserviceaccount.com \\\n --role=\"roles/clouddeploy.jobRunner\"\n\nThe service account will also need runtime-specific permissions to deploy to\nyour chosen runtime. For Google Kubernetes Engine, you might choose the [Container\nDeveloper](/iam/docs/understanding-roles#container.developer) and [Service\nAccount User](/iam/docs/service-account-permissions#user-role) roles. For\nCloud Run, you might choose the [Cloud Run Developer](/run/docs/reference/iam/roles#run.developer)\nand [Service Account User](/iam/docs/service-account-permissions#user-role)\nroles. Other runtimes used by [Custom Targets](/deploy/docs/custom-targets) may require\ntheir own permissions.\n\n### What service accounts to create\n\nIf you choose not to use the default execution service account for rendering and\ndeploying, you need to create one or more alternate service accounts to use.\nThese are service accounts that Cloud Deploy runs as, and they're\n[configured in the target configuration](/deploy/docs/config-files#target_definitions).\n\nOne reason to create more than one would be to have a specific service account\nor accounts for deploying to restricted targets, like a production target.\n\nOne possible approach is to use separate service accounts per delivery pipeline.\nEach such service account would include roles with sufficient permissions to\nrender and to deploy.\n\nFor deployments to Google Kubernetes Engine, you can\n[restrict the service account to one namespace](/deploy/docs/securing/sa-by-namespace).\n\n### Using service accounts from a different project\n\nFor your [execution environment](/deploy/docs/execution-environment), you can\nspecify a service account that's in a different project from the one in which\nyou create your target:\n\n1. On the project that owns the service account, [enable the cross-project SA\n organization policy](/iam/docs/attach-service-accounts#enabling-cross-project).\n\n2. Grant the Cloud Deploy [service agent](#service_agent)\n (`service-\u003cproject-number\u003e@gcp-sa-clouddeploy.iam.gserviceaccount.com`) the\n `iam.serviceAccounts.actAs` permission for your service account.\n\n In this case, `project-number` is the project in which you created your\n target.\n\n You can also grant the [`roles/iam.serviceAccountUser`](/iam/docs/understanding-roles#service-accounts-roles)\n role, which includes that permission, in the project of and on each service\n account that's in a different project from the one where\n Cloud Deploy is running.\n3. Grant the Cloud Build service agent\n (`service-\u003cproject-number\u003e@gcp-sa-cloudbuild.iam.gserviceaccount.com`) the\n `roles/iam.serviceAccountTokenCreator` role.\n\n In this case, `project-number` is the project in which\n you created your target, and this role is granted in the service\n account's project.\n\n You must grant this role for each service account configured in a target's\n execution environment if that service account is in a different project from\n the one where Cloud Deploy is running.\n4. Grant the caller of `gcloud deploy releases create` and `gcloud deploy\n rollouts create` `iam.serviceAccounts.actAs` permission on the service account,\n or the [`roles/iam.serviceAccountUser`](/iam/docs/understanding-roles#service-accounts-roles)\n role.\n\n### Required permissions\n\n- The service account used for rendering configurations must have sufficient\n permissions to access the Cloud Storage bucket where your Cloud Deploy\n resources are stored (delivery pipelines, releases, rollouts).\n\n The role `roles/clouddeploy.jobRunner` includes all permissions the render\n service account ([`privatePool` or `defaultPool`](/deploy/docs/config-files#target_definitions))\n needs.\n- The service account used for deploying must have sufficient permissions to\n deploy to the target cluster, *and* permission to access the\n Cloud Storage bucket.\n\n | **Note:** If you use a custom Cloud Storage bucket, you can put it anywhere. (It doesn't need to be in the same region, for example, as the delivery pipeline.)\n- The service account that calls Cloud Deploy to create a release\n must have the `clouddeploy.releaser` role. It must also have the `iam.serviceAccount.actAs`\n permission to use the service account that renders manifests (for example\n through the [`roles/iam.serviceAccountUser`](/iam/docs/understanding-roles#service-accounts-roles)\n role).\n\n- The service account that calls Cloud Deploy to promote a release\n or create a `rollout` must have the `iam.serviceAccount.actAs` permission to\n use the service account that deploys to targets (for example\n through the [`roles/iam.serviceAccountUser`](/iam/docs/understanding-roles#service-accounts-roles)\n role).\n\n- The service account configured for an [automation](/deploy/docs/automation)\n must have permission to run the operations that are being automated.\n [Learn more](/deploy/docs/automation-resource#automation_service_account).\n\nThe automation service account\n------------------------------\n\nYou can automate some actions in a release. Cloud Deploy runs these\nautomations using the automation service account, which can be the default\nexecution service account, a non-default service account used as the execution\nservice account, or another service account.\n\n[Learn more](/deploy/docs/automation-resource#automation_service_account) about\nthe automation service account.\n\nWhat's next\n-----------\n\n- Learn about [IAM](/iam/docs).\n- Find out about [predefined Cloud Deploy roles](/deploy/docs/iam-roles-permissions#predefined_roles).\n- Understand how to [Create and manage service accounts](/iam/docs/creating-managing-service-accounts)."]]
