Cloud Run roles and permissions
Stay organized with collections Save and categorize content based on your preferences.

This page lists the IAM roles and permissions for Cloud Run. To search through all roles and permissions, see the role and permission index.

Cloud Run roles

Role Permissions

Role	Permissions
Cloud Run Admin (`roles/run.admin`) Full control over all Cloud Run resources. Lowest-level resources where you can grant this role: Cloud Run service Cloud Run job	`recommender.locations.` `recommender.locations.get` `recommender.locations.list` `recommender.runServiceCostInsights.` `recommender.runServiceCostInsights.get` `recommender.runServiceCostInsights.list` `recommender.runServiceCostInsights.update` `recommender.runServiceCostRecommendations.` `recommender.runServiceCostRecommendations.get` `recommender.runServiceCostRecommendations.list` `recommender.runServiceCostRecommendations.update` `recommender.runServiceIdentityInsights.` `recommender.runServiceIdentityInsights.get` `recommender.runServiceIdentityInsights.list` `recommender.runServiceIdentityInsights.update` `recommender.runServiceIdentityRecommendations.` `recommender.runServiceIdentityRecommendations.get` `recommender.runServiceIdentityRecommendations.list` `recommender.runServiceIdentityRecommendations.update` `recommender.runServicePerformanceInsights.` `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update` `recommender.runServiceSecurityInsights.` `recommender.runServiceSecurityInsights.get` `recommender.runServiceSecurityInsights.list` `recommender.runServiceSecurityInsights.update` `recommender.runServiceSecurityRecommendations.` `recommender.runServiceSecurityRecommendations.get` `recommender.runServiceSecurityRecommendations.list` `recommender.runServiceSecurityRecommendations.update` `resourcemanager.projects.get` `resourcemanager.projects.list` `run.` `run.configurations.get` `run.configurations.list` `run.executions.cancel` `run.executions.delete` `run.executions.get` `run.executions.list` `run.jobs.create` `run.jobs.createTagBinding` `run.jobs.delete` `run.jobs.deleteTagBinding` `run.jobs.get` `run.jobs.getIamPolicy` `run.jobs.list` `run.jobs.listEffectiveTags` `run.jobs.listTagBindings` `run.jobs.run` `run.jobs.runWithOverrides` `run.jobs.setIamPolicy` `run.jobs.update` `run.locations.list` `run.operations.delete` `run.operations.get` `run.operations.list` `run.revisions.delete` `run.revisions.get` `run.revisions.list` `run.routes.get` `run.routes.invoke` `run.routes.list` `run.services.create` `run.services.createTagBinding` `run.services.delete` `run.services.deleteTagBinding` `run.services.get` `run.services.getIamPolicy` `run.services.list` `run.services.listEffectiveTags` `run.services.listTagBindings` `run.services.setIamPolicy` `run.services.update` `run.tasks.get` `run.tasks.list`
Cloud Run Builder ^Beta (`roles/run.builder`) Can build Cloud Run functions and source deployed services.	`artifactregistry.repositories.deleteArtifacts` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.uploadArtifacts` `logging.logEntries.create` `source.repos.get` `storage.objects.get`
Cloud Run Developer (`roles/run.developer`) Read and write access to all Cloud Run resources. Lowest-level resources where you can grant this role: Cloud Run service Cloud Run job	`recommender.locations.` `recommender.locations.get` `recommender.locations.list` `recommender.runServiceCostInsights.` `recommender.runServiceCostInsights.get` `recommender.runServiceCostInsights.list` `recommender.runServiceCostInsights.update` `recommender.runServiceCostRecommendations.` `recommender.runServiceCostRecommendations.get` `recommender.runServiceCostRecommendations.list` `recommender.runServiceCostRecommendations.update` `recommender.runServiceIdentityInsights.` `recommender.runServiceIdentityInsights.get` `recommender.runServiceIdentityInsights.list` `recommender.runServiceIdentityInsights.update` `recommender.runServiceIdentityRecommendations.` `recommender.runServiceIdentityRecommendations.get` `recommender.runServiceIdentityRecommendations.list` `recommender.runServiceIdentityRecommendations.update` `recommender.runServicePerformanceInsights.` `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update` `recommender.runServiceSecurityInsights.` `recommender.runServiceSecurityInsights.get` `recommender.runServiceSecurityInsights.list` `recommender.runServiceSecurityInsights.update` `recommender.runServiceSecurityRecommendations.` `recommender.runServiceSecurityRecommendations.get` `recommender.runServiceSecurityRecommendations.list` `recommender.runServiceSecurityRecommendations.update` `resourcemanager.projects.get` `resourcemanager.projects.list` `run.configurations.` `run.configurations.get` `run.configurations.list` `run.executions.` `run.executions.cancel` `run.executions.delete` `run.executions.get` `run.executions.list` `run.jobs.create` `run.jobs.delete` `run.jobs.get` `run.jobs.getIamPolicy` `run.jobs.list` `run.jobs.listEffectiveTags` `run.jobs.listTagBindings` `run.jobs.run` `run.jobs.runWithOverrides` `run.jobs.update` `run.locations.list` `run.operations.` `run.operations.delete` `run.operations.get` `run.operations.list` `run.revisions.` `run.revisions.delete` `run.revisions.get` `run.revisions.list` `run.routes.` `run.routes.get` `run.routes.invoke` `run.routes.list` `run.services.create` `run.services.delete` `run.services.get` `run.services.getIamPolicy` `run.services.list` `run.services.listEffectiveTags` `run.services.listTagBindings` `run.services.update` `run.tasks.*` `run.tasks.get` `run.tasks.list`
Cloud Run Invoker (`roles/run.invoker`) Can invoke Cloud Run services and execute Cloud Run jobs. Lowest-level resources where you can grant this role: Cloud Run service Cloud Run job	`run.jobs.run` `run.routes.invoke`
Cloud Run Jobs Executor (`roles/run.jobsExecutor`) Can execute and cancel Cloud Run jobs.	`run.executions.cancel` `run.jobs.run`
Cloud Run Jobs Executor With Overrides (`roles/run.jobsExecutorWithOverrides`) Can execute and cancel Cloud Run jobs with overrides.	`run.executions.cancel` `run.jobs.run` `run.jobs.runWithOverrides`
Cloud Run Service Agent (`roles/run.serviceAgent`) Gives Cloud Run service account access to managed resources. Warning: Do not grant service agent roles to any principals except service agents.	`artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.dockerimages.` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.locations.` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.*` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.repositories.uploadArtifacts` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `binaryauthorization.platformPolicies.evaluatePolicy` `binaryauthorization.policy.evaluatePolicy` `clientauthconfig.clients.list` `cloudbuild.builds.create` `cloudbuild.builds.get` `compute.addresses.create` `compute.addresses.createInternal` `compute.addresses.delete` `compute.addresses.deleteInternal` `compute.addresses.get` `compute.addresses.list` `compute.globalOperations.get` `compute.networks.access` `compute.networks.get` `compute.subnetworks.get` `compute.subnetworks.use` `iam.serviceAccounts.actAs` `iam.serviceAccounts.getAccessToken` `iam.serviceAccounts.getOpenIdToken` `iam.serviceAccounts.signBlob` `networkservices.meshes.get` `resourcemanager.projects.get` `resourcemanager.projects.getIamPolicy` `resourcemanager.projects.list` `run.routes.invoke` `serviceusage.services.get` `serviceusage.services.use` `storage.folders.get` `storage.folders.list` `storage.managedFolders.get` `storage.managedFolders.list` `storage.objects.get` `storage.objects.list` `vpcaccess.connectors.get` `vpcaccess.connectors.use`
Cloud Run Service Invoker (`roles/run.servicesInvoker`) Can invoke Cloud Run services.	`run.routes.invoke`
Cloud Run Source Developer ^Beta (`roles/run.sourceDeveloper`) Deploy and manage Cloud Run source deployed resources.	`artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.dockerimages.` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.locations.` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.create` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `cloudbuild.builds.create` `cloudbuild.builds.get` `cloudbuild.builds.list` `cloudbuild.builds.update` `cloudbuild.locations.` `cloudbuild.locations.get` `cloudbuild.locations.list` `cloudbuild.operations.` `cloudbuild.operations.get` `cloudbuild.operations.list` `eventarc.channelConnections.create` `eventarc.channelConnections.delete` `eventarc.channelConnections.get` `eventarc.channelConnections.getIamPolicy` `eventarc.channelConnections.list` `eventarc.channelConnections.publish` `eventarc.channels.attach` `eventarc.channels.create` `eventarc.channels.delete` `eventarc.channels.get` `eventarc.channels.getIamPolicy` `eventarc.channels.list` `eventarc.channels.publish` `eventarc.channels.undelete` `eventarc.channels.update` `eventarc.enrollments.create` `eventarc.enrollments.delete` `eventarc.enrollments.get` `eventarc.enrollments.getIamPolicy` `eventarc.enrollments.list` `eventarc.enrollments.update` `eventarc.googleApiSources.create` `eventarc.googleApiSources.delete` `eventarc.googleApiSources.get` `eventarc.googleApiSources.getIamPolicy` `eventarc.googleApiSources.list` `eventarc.googleApiSources.update` `eventarc.googleChannelConfigs.` `eventarc.googleChannelConfigs.get` `eventarc.googleChannelConfigs.update` `eventarc.kafkaSources.create` `eventarc.kafkaSources.delete` `eventarc.kafkaSources.get` `eventarc.kafkaSources.getIamPolicy` `eventarc.kafkaSources.list` `eventarc.locations.` `eventarc.locations.get` `eventarc.locations.list` `eventarc.operations.` `eventarc.operations.cancel` `eventarc.operations.delete` `eventarc.operations.get` `eventarc.operations.list` `eventarc.pipelines.create` `eventarc.pipelines.delete` `eventarc.pipelines.get` `eventarc.pipelines.getIamPolicy` `eventarc.pipelines.list` `eventarc.pipelines.update` `eventarc.providers.` `eventarc.providers.get` `eventarc.providers.list` `eventarc.triggers.create` `eventarc.triggers.delete` `eventarc.triggers.get` `eventarc.triggers.getIamPolicy` `eventarc.triggers.list` `eventarc.triggers.undelete` `eventarc.triggers.update` `orgpolicy.policy.get` `pubsub.messageTransforms.validate` `pubsub.schemas.attach` `pubsub.schemas.commit` `pubsub.schemas.create` `pubsub.schemas.delete` `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.rollback` `pubsub.schemas.validate` `pubsub.snapshots.create` `pubsub.snapshots.delete` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.snapshots.seek` `pubsub.snapshots.update` `pubsub.subscriptions.consume` `pubsub.subscriptions.create` `pubsub.subscriptions.delete` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.subscriptions.update` `pubsub.topics.attachSubscription` `pubsub.topics.create` `pubsub.topics.delete` `pubsub.topics.detachSubscription` `pubsub.topics.get` `pubsub.topics.list` `pubsub.topics.publish` `pubsub.topics.update` `pubsub.topics.updateTag` `recommender.locations.` `recommender.locations.get` `recommender.locations.list` `recommender.runServiceCostInsights.` `recommender.runServiceCostInsights.get` `recommender.runServiceCostInsights.list` `recommender.runServiceCostInsights.update` `recommender.runServiceCostRecommendations.` `recommender.runServiceCostRecommendations.get` `recommender.runServiceCostRecommendations.list` `recommender.runServiceCostRecommendations.update` `recommender.runServiceIdentityInsights.` `recommender.runServiceIdentityInsights.get` `recommender.runServiceIdentityInsights.list` `recommender.runServiceIdentityInsights.update` `recommender.runServiceIdentityRecommendations.` `recommender.runServiceIdentityRecommendations.get` `recommender.runServiceIdentityRecommendations.list` `recommender.runServiceIdentityRecommendations.update` `recommender.runServicePerformanceInsights.` `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceInsights.update` `recommender.runServicePerformanceRecommendations.` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServicePerformanceRecommendations.update` `recommender.runServiceSecurityInsights.` `recommender.runServiceSecurityInsights.get` `recommender.runServiceSecurityInsights.list` `recommender.runServiceSecurityInsights.update` `recommender.runServiceSecurityRecommendations.` `recommender.runServiceSecurityRecommendations.get` `recommender.runServiceSecurityRecommendations.list` `recommender.runServiceSecurityRecommendations.update` `remotebuildexecution.blobs.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `run.configurations.` `run.configurations.get` `run.configurations.list` `run.executions.` `run.executions.cancel` `run.executions.delete` `run.executions.get` `run.executions.list` `run.jobs.create` `run.jobs.delete` `run.jobs.get` `run.jobs.getIamPolicy` `run.jobs.list` `run.jobs.listEffectiveTags` `run.jobs.listTagBindings` `run.jobs.run` `run.jobs.runWithOverrides` `run.jobs.update` `run.locations.list` `run.operations.` `run.operations.delete` `run.operations.get` `run.operations.list` `run.revisions.` `run.revisions.delete` `run.revisions.get` `run.revisions.list` `run.routes.` `run.routes.get` `run.routes.invoke` `run.routes.list` `run.services.create` `run.services.delete` `run.services.get` `run.services.getIamPolicy` `run.services.list` `run.services.listEffectiveTags` `run.services.listTagBindings` `run.services.update` `run.tasks.` `run.tasks.get` `run.tasks.list` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.list` `serviceusage.services.use` `storage.buckets.create` `storage.buckets.get` `storage.buckets.list` `storage.folders.create` `storage.folders.get` `storage.folders.list` `storage.managedFolders.create` `storage.managedFolders.get` `storage.managedFolders.list` `storage.multipartUploads.abort` `storage.multipartUploads.create` `storage.multipartUploads.listParts` `storage.objects.create` `storage.objects.get` `storage.objects.list`
Cloud Run Source Viewer ^Beta (`roles/run.sourceViewer`) View Cloud Run source deployed resources.	`artifactregistry.repositories.get` `artifactregistry.repositories.list` `cloudbuild.builds.get` `cloudbuild.builds.list` `cloudbuild.locations.` `cloudbuild.locations.get` `cloudbuild.locations.list` `cloudbuild.operations.` `cloudbuild.operations.get` `cloudbuild.operations.list` `eventarc.channelConnections.get` `eventarc.channelConnections.getIamPolicy` `eventarc.channelConnections.list` `eventarc.channels.get` `eventarc.channels.getIamPolicy` `eventarc.channels.list` `eventarc.enrollments.get` `eventarc.enrollments.getIamPolicy` `eventarc.enrollments.list` `eventarc.googleApiSources.get` `eventarc.googleApiSources.getIamPolicy` `eventarc.googleApiSources.list` `eventarc.googleChannelConfigs.get` `eventarc.kafkaSources.get` `eventarc.kafkaSources.getIamPolicy` `eventarc.kafkaSources.list` `eventarc.locations.` `eventarc.locations.get` `eventarc.locations.list` `eventarc.messageBuses.get` `eventarc.messageBuses.getIamPolicy` `eventarc.messageBuses.list` `eventarc.messageBuses.use` `eventarc.operations.get` `eventarc.operations.list` `eventarc.pipelines.get` `eventarc.pipelines.getIamPolicy` `eventarc.pipelines.list` `eventarc.providers.` `eventarc.providers.get` `eventarc.providers.list` `eventarc.triggers.get` `eventarc.triggers.getIamPolicy` `eventarc.triggers.list` `pubsub.messageTransforms.validate` `pubsub.schemas.get` `pubsub.schemas.list` `pubsub.schemas.listRevisions` `pubsub.schemas.validate` `pubsub.snapshots.get` `pubsub.snapshots.list` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.topics.get` `pubsub.topics.list` `recommender.locations.` `recommender.locations.get` `recommender.locations.list` `recommender.runServiceCostInsights.get` `recommender.runServiceCostInsights.list` `recommender.runServiceCostRecommendations.get` `recommender.runServiceCostRecommendations.list` `recommender.runServiceIdentityInsights.get` `recommender.runServiceIdentityInsights.list` `recommender.runServiceIdentityRecommendations.get` `recommender.runServiceIdentityRecommendations.list` `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServiceSecurityInsights.get` `recommender.runServiceSecurityInsights.list` `recommender.runServiceSecurityRecommendations.get` `recommender.runServiceSecurityRecommendations.list` `remotebuildexecution.blobs.get` `resourcemanager.projects.get` `resourcemanager.projects.list` `run.configurations.` `run.configurations.get` `run.configurations.list` `run.executions.get` `run.executions.list` `run.jobs.get` `run.jobs.getIamPolicy` `run.jobs.list` `run.jobs.listEffectiveTags` `run.jobs.listTagBindings` `run.locations.list` `run.operations.get` `run.operations.list` `run.revisions.get` `run.revisions.list` `run.routes.get` `run.routes.list` `run.services.get` `run.services.getIamPolicy` `run.services.list` `run.services.listEffectiveTags` `run.services.listTagBindings` `run.tasks.*` `run.tasks.get` `run.tasks.list` `serviceusage.quotas.get` `serviceusage.services.get` `serviceusage.services.list` `storage.folders.get` `storage.folders.list` `storage.managedFolders.get` `storage.managedFolders.list` `storage.objects.get` `storage.objects.list`
Cloud Run Viewer (`roles/run.viewer`) Can view the state of all Cloud Run resources, including IAM policies. Lowest-level resources where you can grant this role: Cloud Run service Cloud Run job	`recommender.locations.` `recommender.locations.get` `recommender.locations.list` `recommender.runServiceCostInsights.get` `recommender.runServiceCostInsights.list` `recommender.runServiceCostRecommendations.get` `recommender.runServiceCostRecommendations.list` `recommender.runServiceIdentityInsights.get` `recommender.runServiceIdentityInsights.list` `recommender.runServiceIdentityRecommendations.get` `recommender.runServiceIdentityRecommendations.list` `recommender.runServicePerformanceInsights.get` `recommender.runServicePerformanceInsights.list` `recommender.runServicePerformanceRecommendations.get` `recommender.runServicePerformanceRecommendations.list` `recommender.runServiceSecurityInsights.get` `recommender.runServiceSecurityInsights.list` `recommender.runServiceSecurityRecommendations.get` `recommender.runServiceSecurityRecommendations.list` `resourcemanager.projects.get` `resourcemanager.projects.list` `run.configurations.` `run.configurations.get` `run.configurations.list` `run.executions.get` `run.executions.list` `run.jobs.get` `run.jobs.getIamPolicy` `run.jobs.list` `run.jobs.listEffectiveTags` `run.jobs.listTagBindings` `run.locations.list` `run.operations.get` `run.operations.list` `run.revisions.get` `run.revisions.list` `run.routes.get` `run.routes.list` `run.services.get` `run.services.getIamPolicy` `run.services.list` `run.services.listEffectiveTags` `run.services.listTagBindings` `run.tasks.*` `run.tasks.get` `run.tasks.list`
Cloud Run Service Agent (`roles/serverless.serviceAgent`) Gives Cloud Run service account access to managed resources.	`artifactregistry.attachments.get` `artifactregistry.attachments.list` `artifactregistry.dockerimages.` `artifactregistry.dockerimages.get` `artifactregistry.dockerimages.list` `artifactregistry.files.download` `artifactregistry.files.get` `artifactregistry.files.list` `artifactregistry.locations.` `artifactregistry.locations.get` `artifactregistry.locations.list` `artifactregistry.mavenartifacts.` `artifactregistry.mavenartifacts.get` `artifactregistry.mavenartifacts.list` `artifactregistry.npmpackages.` `artifactregistry.npmpackages.get` `artifactregistry.npmpackages.list` `artifactregistry.packages.get` `artifactregistry.packages.list` `artifactregistry.projectsettings.get` `artifactregistry.pythonpackages.*` `artifactregistry.pythonpackages.get` `artifactregistry.pythonpackages.list` `artifactregistry.repositories.downloadArtifacts` `artifactregistry.repositories.get` `artifactregistry.repositories.list` `artifactregistry.repositories.listEffectiveTags` `artifactregistry.repositories.listTagBindings` `artifactregistry.repositories.readViaVirtualRepository` `artifactregistry.rules.get` `artifactregistry.rules.list` `artifactregistry.tags.get` `artifactregistry.tags.list` `artifactregistry.versions.get` `artifactregistry.versions.list` `binaryauthorization.platformPolicies.evaluatePolicy` `binaryauthorization.policy.evaluatePolicy` `clientauthconfig.clients.list` `cloudbuild.builds.create` `cloudbuild.builds.get` `compute.addresses.create` `compute.addresses.createInternal` `compute.addresses.delete` `compute.addresses.deleteInternal` `compute.addresses.get` `compute.addresses.list` `compute.globalOperations.get` `compute.networks.access` `compute.networks.get` `compute.subnetworks.get` `compute.subnetworks.use` `iam.serviceAccounts.actAs` `iam.serviceAccounts.getAccessToken` `iam.serviceAccounts.getOpenIdToken` `iam.serviceAccounts.signBlob` `pubsub.subscriptions.create` `pubsub.subscriptions.delete` `pubsub.subscriptions.get` `pubsub.subscriptions.list` `pubsub.topics.attachSubscription` `pubsub.topics.create` `pubsub.topics.delete` `pubsub.topics.get` `pubsub.topics.list` `pubsub.topics.publish` `resourcemanager.projects.get` `resourcemanager.projects.getIamPolicy` `resourcemanager.projects.list` `run.routes.invoke` `serviceusage.services.use` `storage.folders.get` `storage.folders.list` `storage.managedFolders.get` `storage.managedFolders.list` `storage.objects.get` `storage.objects.list` `vpcaccess.connectors.get` `vpcaccess.connectors.use`

Cloud Run Admin

(roles/run.admin)

Full control over all Cloud Run resources.

Lowest-level resources where you can grant this role:

Cloud Run service
Cloud Run job

recommender.locations.*

recommender.locations.get
recommender.locations.list

recommender.runServiceCostInsights.*

recommender.runServiceCostInsights.get
recommender.runServiceCostInsights.list
recommender.runServiceCostInsights.update

recommender.runServiceCostRecommendations.*

recommender.runServiceCostRecommendations.get
recommender.runServiceCostRecommendations.list
recommender.runServiceCostRecommendations.update

recommender.runServiceIdentityInsights.*

recommender.runServiceIdentityInsights.get
recommender.runServiceIdentityInsights.list
recommender.runServiceIdentityInsights.update

recommender.runServiceIdentityRecommendations.*

recommender.runServiceIdentityRecommendations.get
recommender.runServiceIdentityRecommendations.list
recommender.runServiceIdentityRecommendations.update

recommender.runServicePerformanceInsights.*

recommender.runServicePerformanceInsights.get
recommender.runServicePerformanceInsights.list
recommender.runServicePerformanceInsights.update

recommender.runServicePerformanceRecommendations.*

recommender.runServicePerformanceRecommendations.get
recommender.runServicePerformanceRecommendations.list
recommender.runServicePerformanceRecommendations.update

recommender.runServiceSecurityInsights.*

recommender.runServiceSecurityInsights.get
recommender.runServiceSecurityInsights.list
recommender.runServiceSecurityInsights.update

recommender.runServiceSecurityRecommendations.*

recommender.runServiceSecurityRecommendations.get
recommender.runServiceSecurityRecommendations.list
recommender.runServiceSecurityRecommendations.update

resourcemanager.projects.get

resourcemanager.projects.list

run.*

run.configurations.get
run.configurations.list
run.executions.cancel
run.executions.delete
run.executions.get
run.executions.list
run.jobs.create
run.jobs.createTagBinding
run.jobs.delete
run.jobs.deleteTagBinding
run.jobs.get
run.jobs.getIamPolicy
run.jobs.list
run.jobs.listEffectiveTags
run.jobs.listTagBindings
run.jobs.run
run.jobs.runWithOverrides
run.jobs.setIamPolicy
run.jobs.update
run.locations.list
run.operations.delete
run.operations.get
run.operations.list
run.revisions.delete
run.revisions.get
run.revisions.list
run.routes.get
run.routes.invoke
run.routes.list
run.services.create
run.services.createTagBinding
run.services.delete
run.services.deleteTagBinding
run.services.get
run.services.getIamPolicy
run.services.list
run.services.listEffectiveTags
run.services.listTagBindings
run.services.setIamPolicy
run.services.update
run.tasks.get
run.tasks.list

Cloud Run Builder ^Beta

(roles/run.builder)

Can build Cloud Run functions and source deployed services.

artifactregistry.repositories.deleteArtifacts

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.uploadArtifacts

logging.logEntries.create

source.repos.get

storage.objects.get

Cloud Run Developer

(roles/run.developer)

Read and write access to all Cloud Run resources.

Lowest-level resources where you can grant this role:

Cloud Run service
Cloud Run job

recommender.locations.*

recommender.locations.get
recommender.locations.list

recommender.runServiceCostInsights.*

recommender.runServiceCostInsights.get
recommender.runServiceCostInsights.list
recommender.runServiceCostInsights.update

recommender.runServiceCostRecommendations.*

recommender.runServiceCostRecommendations.get
recommender.runServiceCostRecommendations.list
recommender.runServiceCostRecommendations.update

recommender.runServiceIdentityInsights.*

recommender.runServiceIdentityInsights.get
recommender.runServiceIdentityInsights.list
recommender.runServiceIdentityInsights.update

recommender.runServiceIdentityRecommendations.*

recommender.runServiceIdentityRecommendations.get
recommender.runServiceIdentityRecommendations.list
recommender.runServiceIdentityRecommendations.update

recommender.runServicePerformanceInsights.*

recommender.runServicePerformanceInsights.get
recommender.runServicePerformanceInsights.list
recommender.runServicePerformanceInsights.update

recommender.runServicePerformanceRecommendations.*

recommender.runServicePerformanceRecommendations.get
recommender.runServicePerformanceRecommendations.list
recommender.runServicePerformanceRecommendations.update

recommender.runServiceSecurityInsights.*

recommender.runServiceSecurityInsights.get
recommender.runServiceSecurityInsights.list
recommender.runServiceSecurityInsights.update

recommender.runServiceSecurityRecommendations.*

recommender.runServiceSecurityRecommendations.get
recommender.runServiceSecurityRecommendations.list
recommender.runServiceSecurityRecommendations.update

resourcemanager.projects.get

resourcemanager.projects.list

run.configurations.*

run.configurations.get
run.configurations.list

run.executions.*

run.executions.cancel
run.executions.delete
run.executions.get
run.executions.list

run.jobs.create

run.jobs.delete

run.jobs.get

run.jobs.getIamPolicy

run.jobs.list

run.jobs.listEffectiveTags

run.jobs.listTagBindings

run.jobs.run

run.jobs.runWithOverrides

run.jobs.update

run.locations.list

run.operations.*

run.operations.delete
run.operations.get
run.operations.list

run.revisions.*

run.revisions.delete
run.revisions.get
run.revisions.list

run.routes.*

run.routes.get
run.routes.invoke
run.routes.list

run.services.create

run.services.delete

run.services.get

run.services.getIamPolicy

run.services.list

run.services.listEffectiveTags

run.services.listTagBindings

run.services.update

run.tasks.*

run.tasks.get
run.tasks.list

Cloud Run Invoker

(roles/run.invoker)

Can invoke Cloud Run services and execute Cloud Run jobs.

Lowest-level resources where you can grant this role:

Cloud Run service
Cloud Run job

run.jobs.run

run.routes.invoke

Cloud Run Jobs Executor

(roles/run.jobsExecutor)

Can execute and cancel Cloud Run jobs.

run.executions.cancel

run.jobs.run

Cloud Run Jobs Executor With Overrides

(roles/run.jobsExecutorWithOverrides)

Can execute and cancel Cloud Run jobs with overrides.

run.executions.cancel

run.jobs.run

run.jobs.runWithOverrides

Cloud Run Service Agent

(roles/run.serviceAgent)

Gives Cloud Run service account access to managed resources.

artifactregistry.attachments.get

artifactregistry.attachments.list

artifactregistry.dockerimages.*

artifactregistry.dockerimages.get
artifactregistry.dockerimages.list

artifactregistry.files.download

artifactregistry.files.get

artifactregistry.files.list

artifactregistry.locations.*

artifactregistry.locations.get
artifactregistry.locations.list

artifactregistry.mavenartifacts.*

artifactregistry.mavenartifacts.get
artifactregistry.mavenartifacts.list

artifactregistry.npmpackages.*

artifactregistry.npmpackages.get
artifactregistry.npmpackages.list

artifactregistry.packages.get

artifactregistry.packages.list

artifactregistry.projectsettings.get

artifactregistry.pythonpackages.*

artifactregistry.pythonpackages.get
artifactregistry.pythonpackages.list

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.get

artifactregistry.repositories.list

artifactregistry.repositories.listEffectiveTags

artifactregistry.repositories.listTagBindings

artifactregistry.repositories.readViaVirtualRepository

artifactregistry.repositories.uploadArtifacts

artifactregistry.rules.get

artifactregistry.rules.list

artifactregistry.tags.get

artifactregistry.tags.list

artifactregistry.versions.get

artifactregistry.versions.list

binaryauthorization.platformPolicies.evaluatePolicy

binaryauthorization.policy.evaluatePolicy

clientauthconfig.clients.list

cloudbuild.builds.create

cloudbuild.builds.get

compute.addresses.create

compute.addresses.createInternal

compute.addresses.delete

compute.addresses.deleteInternal

compute.addresses.get

compute.addresses.list

compute.globalOperations.get

compute.networks.access

compute.networks.get

compute.subnetworks.get

compute.subnetworks.use

iam.serviceAccounts.actAs

iam.serviceAccounts.getAccessToken

iam.serviceAccounts.getOpenIdToken

iam.serviceAccounts.signBlob

networkservices.meshes.get

resourcemanager.projects.get

resourcemanager.projects.getIamPolicy

resourcemanager.projects.list

run.routes.invoke

serviceusage.services.get

serviceusage.services.use

storage.folders.get

storage.folders.list

storage.managedFolders.get

storage.managedFolders.list

storage.objects.get

storage.objects.list

vpcaccess.connectors.get

vpcaccess.connectors.use

Cloud Run Service Invoker

(roles/run.servicesInvoker)

Can invoke Cloud Run services.

run.routes.invoke

Cloud Run Source Developer ^Beta

(roles/run.sourceDeveloper)

Deploy and manage Cloud Run source deployed resources.

artifactregistry.attachments.get

artifactregistry.attachments.list

artifactregistry.dockerimages.*

artifactregistry.dockerimages.get
artifactregistry.dockerimages.list

artifactregistry.files.download

artifactregistry.files.get

artifactregistry.files.list

artifactregistry.locations.*

artifactregistry.locations.get
artifactregistry.locations.list

artifactregistry.mavenartifacts.*

artifactregistry.mavenartifacts.get
artifactregistry.mavenartifacts.list

artifactregistry.npmpackages.*

artifactregistry.npmpackages.get
artifactregistry.npmpackages.list

artifactregistry.packages.get

artifactregistry.packages.list

artifactregistry.projectsettings.get

artifactregistry.pythonpackages.*

artifactregistry.pythonpackages.get
artifactregistry.pythonpackages.list

artifactregistry.repositories.create

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.get

artifactregistry.repositories.list

artifactregistry.repositories.listEffectiveTags

artifactregistry.repositories.listTagBindings

artifactregistry.repositories.readViaVirtualRepository

artifactregistry.rules.get

artifactregistry.rules.list

artifactregistry.tags.get

artifactregistry.tags.list

artifactregistry.versions.get

artifactregistry.versions.list

cloudbuild.builds.create

cloudbuild.builds.get

cloudbuild.builds.list

cloudbuild.builds.update

cloudbuild.locations.*

cloudbuild.locations.get
cloudbuild.locations.list

cloudbuild.operations.*

cloudbuild.operations.get
cloudbuild.operations.list

eventarc.channelConnections.create

eventarc.channelConnections.delete

eventarc.channelConnections.get

eventarc.channelConnections.getIamPolicy

eventarc.channelConnections.list

eventarc.channelConnections.publish

eventarc.channels.attach

eventarc.channels.create

eventarc.channels.delete

eventarc.channels.get

eventarc.channels.getIamPolicy

eventarc.channels.list

eventarc.channels.publish

eventarc.channels.undelete

eventarc.channels.update

eventarc.enrollments.create

eventarc.enrollments.delete

eventarc.enrollments.get

eventarc.enrollments.getIamPolicy

eventarc.enrollments.list

eventarc.enrollments.update

eventarc.googleApiSources.create

eventarc.googleApiSources.delete

eventarc.googleApiSources.get

eventarc.googleApiSources.getIamPolicy

eventarc.googleApiSources.list

eventarc.googleApiSources.update

eventarc.googleChannelConfigs.*

eventarc.googleChannelConfigs.get
eventarc.googleChannelConfigs.update

eventarc.kafkaSources.create

eventarc.kafkaSources.delete

eventarc.kafkaSources.get

eventarc.kafkaSources.getIamPolicy

eventarc.kafkaSources.list

eventarc.locations.*

eventarc.locations.get
eventarc.locations.list

eventarc.operations.*

eventarc.operations.cancel
eventarc.operations.delete
eventarc.operations.get
eventarc.operations.list

eventarc.pipelines.create

eventarc.pipelines.delete

eventarc.pipelines.get

eventarc.pipelines.getIamPolicy

eventarc.pipelines.list

eventarc.pipelines.update

eventarc.providers.*

eventarc.providers.get
eventarc.providers.list

eventarc.triggers.create

eventarc.triggers.delete

eventarc.triggers.get

eventarc.triggers.getIamPolicy

eventarc.triggers.list

eventarc.triggers.undelete

eventarc.triggers.update

orgpolicy.policy.get

pubsub.messageTransforms.validate

pubsub.schemas.attach

pubsub.schemas.commit

pubsub.schemas.create

pubsub.schemas.delete

pubsub.schemas.get

pubsub.schemas.list

pubsub.schemas.listRevisions

pubsub.schemas.rollback

pubsub.schemas.validate

pubsub.snapshots.create

pubsub.snapshots.delete

pubsub.snapshots.get

pubsub.snapshots.list

pubsub.snapshots.seek

pubsub.snapshots.update

pubsub.subscriptions.consume

pubsub.subscriptions.create

pubsub.subscriptions.delete

pubsub.subscriptions.get

pubsub.subscriptions.list

pubsub.subscriptions.update

pubsub.topics.attachSubscription

pubsub.topics.create

pubsub.topics.delete

pubsub.topics.detachSubscription

pubsub.topics.get

pubsub.topics.list

pubsub.topics.publish

pubsub.topics.update

pubsub.topics.updateTag

recommender.locations.*

recommender.locations.get
recommender.locations.list

recommender.runServiceCostInsights.*

recommender.runServiceCostInsights.get
recommender.runServiceCostInsights.list
recommender.runServiceCostInsights.update

recommender.runServiceCostRecommendations.*

recommender.runServiceCostRecommendations.get
recommender.runServiceCostRecommendations.list
recommender.runServiceCostRecommendations.update

recommender.runServiceIdentityInsights.*

recommender.runServiceIdentityInsights.get
recommender.runServiceIdentityInsights.list
recommender.runServiceIdentityInsights.update

recommender.runServiceIdentityRecommendations.*

recommender.runServiceIdentityRecommendations.get
recommender.runServiceIdentityRecommendations.list
recommender.runServiceIdentityRecommendations.update

recommender.runServicePerformanceInsights.*

recommender.runServicePerformanceInsights.get
recommender.runServicePerformanceInsights.list
recommender.runServicePerformanceInsights.update

recommender.runServicePerformanceRecommendations.*

recommender.runServicePerformanceRecommendations.get
recommender.runServicePerformanceRecommendations.list
recommender.runServicePerformanceRecommendations.update

recommender.runServiceSecurityInsights.*

recommender.runServiceSecurityInsights.get
recommender.runServiceSecurityInsights.list
recommender.runServiceSecurityInsights.update

recommender.runServiceSecurityRecommendations.*

recommender.runServiceSecurityRecommendations.get
recommender.runServiceSecurityRecommendations.list
recommender.runServiceSecurityRecommendations.update

remotebuildexecution.blobs.get

resourcemanager.projects.get

resourcemanager.projects.list

run.configurations.*

run.configurations.get
run.configurations.list

run.executions.*

run.executions.cancel
run.executions.delete
run.executions.get
run.executions.list

run.jobs.create

run.jobs.delete

run.jobs.get

run.jobs.getIamPolicy

run.jobs.list

run.jobs.listEffectiveTags

run.jobs.listTagBindings

run.jobs.run

run.jobs.runWithOverrides

run.jobs.update

run.locations.list

run.operations.*

run.operations.delete
run.operations.get
run.operations.list

run.revisions.*

run.revisions.delete
run.revisions.get
run.revisions.list

run.routes.*

run.routes.get
run.routes.invoke
run.routes.list

run.services.create

run.services.delete

run.services.get

run.services.getIamPolicy

run.services.list

run.services.listEffectiveTags

run.services.listTagBindings

run.services.update

run.tasks.*

run.tasks.get
run.tasks.list

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

serviceusage.services.use

storage.buckets.create

storage.buckets.get

storage.buckets.list

storage.folders.create

storage.folders.get

storage.folders.list

storage.managedFolders.create

storage.managedFolders.get

storage.managedFolders.list

storage.multipartUploads.abort

storage.multipartUploads.create

storage.multipartUploads.listParts

storage.objects.create

storage.objects.get

storage.objects.list

Cloud Run Source Viewer ^Beta

(roles/run.sourceViewer)

View Cloud Run source deployed resources.

artifactregistry.repositories.get

artifactregistry.repositories.list

cloudbuild.builds.get

cloudbuild.builds.list

cloudbuild.locations.*

cloudbuild.locations.get
cloudbuild.locations.list

cloudbuild.operations.*

cloudbuild.operations.get
cloudbuild.operations.list

eventarc.channelConnections.get

eventarc.channelConnections.getIamPolicy

eventarc.channelConnections.list

eventarc.channels.get

eventarc.channels.getIamPolicy

eventarc.channels.list

eventarc.enrollments.get

eventarc.enrollments.getIamPolicy

eventarc.enrollments.list

eventarc.googleApiSources.get

eventarc.googleApiSources.getIamPolicy

eventarc.googleApiSources.list

eventarc.googleChannelConfigs.get

eventarc.kafkaSources.get

eventarc.kafkaSources.getIamPolicy

eventarc.kafkaSources.list

eventarc.locations.*

eventarc.locations.get
eventarc.locations.list

eventarc.messageBuses.get

eventarc.messageBuses.getIamPolicy

eventarc.messageBuses.list

eventarc.messageBuses.use

eventarc.operations.get

eventarc.operations.list

eventarc.pipelines.get

eventarc.pipelines.getIamPolicy

eventarc.pipelines.list

eventarc.providers.*

eventarc.providers.get
eventarc.providers.list

eventarc.triggers.get

eventarc.triggers.getIamPolicy

eventarc.triggers.list

pubsub.messageTransforms.validate

pubsub.schemas.get

pubsub.schemas.list

pubsub.schemas.listRevisions

pubsub.schemas.validate

pubsub.snapshots.get

pubsub.snapshots.list

pubsub.subscriptions.get

pubsub.subscriptions.list

pubsub.topics.get

pubsub.topics.list

recommender.locations.*

recommender.locations.get
recommender.locations.list

recommender.runServiceCostInsights.get

recommender.runServiceCostInsights.list

recommender.runServiceCostRecommendations.get

recommender.runServiceCostRecommendations.list

recommender.runServiceIdentityInsights.get

recommender.runServiceIdentityInsights.list

recommender.runServiceIdentityRecommendations.get

recommender.runServiceIdentityRecommendations.list

recommender.runServicePerformanceInsights.get

recommender.runServicePerformanceInsights.list

recommender.runServicePerformanceRecommendations.get

recommender.runServicePerformanceRecommendations.list

recommender.runServiceSecurityInsights.get

recommender.runServiceSecurityInsights.list

recommender.runServiceSecurityRecommendations.get

recommender.runServiceSecurityRecommendations.list

remotebuildexecution.blobs.get

resourcemanager.projects.get

resourcemanager.projects.list

run.configurations.*

run.configurations.get
run.configurations.list

run.executions.get

run.executions.list

run.jobs.get

run.jobs.getIamPolicy

run.jobs.list

run.jobs.listEffectiveTags

run.jobs.listTagBindings

run.locations.list

run.operations.get

run.operations.list

run.revisions.get

run.revisions.list

run.routes.get

run.routes.list

run.services.get

run.services.getIamPolicy

run.services.list

run.services.listEffectiveTags

run.services.listTagBindings

run.tasks.*

run.tasks.get
run.tasks.list

serviceusage.quotas.get

serviceusage.services.get

serviceusage.services.list

storage.folders.get

storage.folders.list

storage.managedFolders.get

storage.managedFolders.list

storage.objects.get

storage.objects.list

Cloud Run Viewer

(roles/run.viewer)

Can view the state of all Cloud Run resources, including IAM policies.

Lowest-level resources where you can grant this role:

Cloud Run service
Cloud Run job

recommender.locations.*

recommender.locations.get
recommender.locations.list

recommender.runServiceCostInsights.get

recommender.runServiceCostInsights.list

recommender.runServiceCostRecommendations.get

recommender.runServiceCostRecommendations.list

recommender.runServiceIdentityInsights.get

recommender.runServiceIdentityInsights.list

recommender.runServiceIdentityRecommendations.get

recommender.runServiceIdentityRecommendations.list

recommender.runServicePerformanceInsights.get

recommender.runServicePerformanceInsights.list

recommender.runServicePerformanceRecommendations.get

recommender.runServicePerformanceRecommendations.list

recommender.runServiceSecurityInsights.get

recommender.runServiceSecurityInsights.list

recommender.runServiceSecurityRecommendations.get

recommender.runServiceSecurityRecommendations.list

resourcemanager.projects.get

resourcemanager.projects.list

run.configurations.*

run.configurations.get
run.configurations.list

run.executions.get

run.executions.list

run.jobs.get

run.jobs.getIamPolicy

run.jobs.list

run.jobs.listEffectiveTags

run.jobs.listTagBindings

run.locations.list

run.operations.get

run.operations.list

run.revisions.get

run.revisions.list

run.routes.get

run.routes.list

run.services.get

run.services.getIamPolicy

run.services.list

run.services.listEffectiveTags

run.services.listTagBindings

run.tasks.*

run.tasks.get
run.tasks.list

Cloud Run Service Agent

(roles/serverless.serviceAgent)

Gives Cloud Run service account access to managed resources.

artifactregistry.attachments.get

artifactregistry.attachments.list

artifactregistry.dockerimages.*

artifactregistry.dockerimages.get
artifactregistry.dockerimages.list

artifactregistry.files.download

artifactregistry.files.get

artifactregistry.files.list

artifactregistry.locations.*

artifactregistry.locations.get
artifactregistry.locations.list

artifactregistry.mavenartifacts.*

artifactregistry.mavenartifacts.get
artifactregistry.mavenartifacts.list

artifactregistry.npmpackages.*

artifactregistry.npmpackages.get
artifactregistry.npmpackages.list

artifactregistry.packages.get

artifactregistry.packages.list

artifactregistry.projectsettings.get

artifactregistry.pythonpackages.*

artifactregistry.pythonpackages.get
artifactregistry.pythonpackages.list

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.get

artifactregistry.repositories.list

artifactregistry.repositories.listEffectiveTags

artifactregistry.repositories.listTagBindings

artifactregistry.repositories.readViaVirtualRepository

artifactregistry.rules.get

artifactregistry.rules.list

artifactregistry.tags.get

artifactregistry.tags.list

artifactregistry.versions.get

artifactregistry.versions.list

binaryauthorization.platformPolicies.evaluatePolicy

binaryauthorization.policy.evaluatePolicy

clientauthconfig.clients.list

cloudbuild.builds.create

cloudbuild.builds.get

compute.addresses.create

compute.addresses.createInternal

compute.addresses.delete

compute.addresses.deleteInternal

compute.addresses.get

compute.addresses.list

compute.globalOperations.get

compute.networks.access

compute.networks.get

compute.subnetworks.get

compute.subnetworks.use

iam.serviceAccounts.actAs

iam.serviceAccounts.getAccessToken

iam.serviceAccounts.getOpenIdToken

iam.serviceAccounts.signBlob

pubsub.subscriptions.create

pubsub.subscriptions.delete

pubsub.subscriptions.get

pubsub.subscriptions.list

pubsub.topics.attachSubscription

pubsub.topics.create

pubsub.topics.delete

pubsub.topics.get

pubsub.topics.list

pubsub.topics.publish

resourcemanager.projects.get

resourcemanager.projects.getIamPolicy

resourcemanager.projects.list

run.routes.invoke

serviceusage.services.use

storage.folders.get

storage.folders.list

storage.managedFolders.get

storage.managedFolders.list

storage.objects.get

storage.objects.list

vpcaccess.connectors.get

vpcaccess.connectors.use

Cloud Run permissions

Permission	Included in roles
`run.configurations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.configurations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.executions.cancel`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Jobs Executor (`roles/run.jobsExecutor`) Cloud Run Jobs Executor With Overrides (`roles/run.jobsExecutorWithOverrides`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.executions.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Vertex AI Service Agent (`roles/aiplatform.serviceAgent`)
`run.executions.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Vertex AI Service Agent (`roles/aiplatform.serviceAgent`)
`run.executions.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.jobs.create`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Vertex AI Service Agent (`roles/aiplatform.serviceAgent`)
`run.jobs.createTagBinding`	Owner (`roles/owner`) Cloud Functions Admin (`roles/cloudfunctions.admin`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Tag User (`roles/resourcemanager.tagUser`) Cloud Run Admin (`roles/run.admin`)
`run.jobs.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Vertex AI Service Agent (`roles/aiplatform.serviceAgent`)
`run.jobs.deleteTagBinding`	Owner (`roles/owner`) Cloud Functions Admin (`roles/cloudfunctions.admin`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Tag User (`roles/resourcemanager.tagUser`) Cloud Run Admin (`roles/run.admin`)
`run.jobs.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Eventarc Service Agent (`roles/eventarc.serviceAgent`) Serverless Integrations Service Agent (`roles/runapps.serviceAgent`) Vertex AI Service Agent (`roles/aiplatform.serviceAgent`)
`run.jobs.getIamPolicy`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.jobs.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Serverless Integrations Service Agent (`roles/runapps.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.jobs.listEffectiveTags`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Tag User (`roles/resourcemanager.tagUser`) Tag Viewer (`roles/resourcemanager.tagViewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.jobs.listTagBindings`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Tag User (`roles/resourcemanager.tagUser`) Tag Viewer (`roles/resourcemanager.tagViewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.jobs.run`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Invoker (`roles/run.invoker`) Cloud Run Jobs Executor (`roles/run.jobsExecutor`) Cloud Run Jobs Executor With Overrides (`roles/run.jobsExecutorWithOverrides`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Dialogflow Service Agent (`roles/dialogflow.serviceAgent`) Application Integration Service Agent (`roles/integrations.serviceAgent`) Cloud Vision AI Service Agent (`roles/visionai.serviceAgent`) Vertex AI Service Agent (`roles/aiplatform.serviceAgent`)
`run.jobs.runWithOverrides`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Jobs Executor With Overrides (`roles/run.jobsExecutorWithOverrides`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.jobs.setIamPolicy`	Owner (`roles/owner`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Security Admin (`roles/iam.securityAdmin`) Cloud Run Admin (`roles/run.admin`)
`run.jobs.update`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Vertex AI Service Agent (`roles/aiplatform.serviceAgent`)
`run.locations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.operations.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Firebase App Hosting Service Agent (`roles/firebaseapphosting.serviceAgent`) Vertex AI Service Agent (`roles/aiplatform.serviceAgent`)
`run.operations.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Firebase App Hosting Service Agent (`roles/firebaseapphosting.serviceAgent`) Vertex AI Service Agent (`roles/aiplatform.serviceAgent`)
`run.operations.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.revisions.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase App Hosting Service Agent (`roles/firebaseapphosting.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.revisions.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase App Hosting Service Agent (`roles/firebaseapphosting.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.revisions.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.routes.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase App Hosting Service Agent (`roles/firebaseapphosting.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.routes.invoke`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Invoker (`roles/run.invoker`) Cloud Run Service Invoker (`roles/run.servicesInvoker`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Service Agent (`roles/serverless.serviceAgent`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Dialogflow Service Agent (`roles/dialogflow.serviceAgent`) Firebase App Hosting Service Agent (`roles/firebaseapphosting.serviceAgent`) Application Integration Service Agent (`roles/integrations.serviceAgent`) Monitoring Service Agent (`roles/monitoring.notificationServiceAgent`) Cloud Run Service Agent (`roles/run.serviceAgent`) Cloud Vision AI Service Agent (`roles/visionai.serviceAgent`) Vertex AI Service Agent (`roles/aiplatform.serviceAgent`)
`run.routes.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.services.create`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Firebase App Hosting Service Agent (`roles/firebaseapphosting.serviceAgent`) Vertex AI Service Agent (`roles/aiplatform.serviceAgent`)
`run.services.createTagBinding`	Owner (`roles/owner`) Cloud Functions Admin (`roles/cloudfunctions.admin`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Tag User (`roles/resourcemanager.tagUser`) Cloud Run Admin (`roles/run.admin`)
`run.services.delete`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Firebase App Hosting Service Agent (`roles/firebaseapphosting.serviceAgent`) Vertex AI Service Agent (`roles/aiplatform.serviceAgent`)
`run.services.deleteTagBinding`	Owner (`roles/owner`) Cloud Functions Admin (`roles/cloudfunctions.admin`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Tag User (`roles/resourcemanager.tagUser`) Cloud Run Admin (`roles/run.admin`)
`run.services.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`) Eventarc Service Agent (`roles/eventarc.serviceAgent`) Firebase App Hosting Service Agent (`roles/firebaseapphosting.serviceAgent`) Serverless Integrations Service Agent (`roles/runapps.serviceAgent`) Vertex AI Service Agent (`roles/aiplatform.serviceAgent`)
`run.services.getIamPolicy`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Firebase Extensions API Service Agent (`roles/firebasemods.serviceAgent`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.services.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Serverless Integrations Service Agent (`roles/runapps.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.services.listEffectiveTags`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Tag User (`roles/resourcemanager.tagUser`) Tag Viewer (`roles/resourcemanager.tagViewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.services.listTagBindings`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) DLP Organization Data Profiles Driver (`roles/dlp.orgdriver`) DLP Project Data Profiles Driver (`roles/dlp.projectdriver`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Tag User (`roles/resourcemanager.tagUser`) Tag Viewer (`roles/resourcemanager.tagViewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.services.setIamPolicy`	Owner (`roles/owner`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Extensions API Service Agent (`roles/firebasemods.serviceAgent`) Security Admin (`roles/iam.securityAdmin`) Cloud Run Admin (`roles/run.admin`)
`run.services.update`	Owner (`roles/owner`) Editor (`roles/editor`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Firebase App Hosting Service Agent (`roles/firebaseapphosting.serviceAgent`) Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.tasks.get`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)
`run.tasks.list`	Owner (`roles/owner`) Editor (`roles/editor`) Viewer (`roles/viewer`) Cloud Functions Admin (`roles/cloudfunctions.admin`) Cloud Functions Developer (`roles/cloudfunctions.developer`) Cloud Functions Viewer (`roles/cloudfunctions.viewer`) Firebase Admin (`roles/firebase.admin`) Firebase Develop Admin (`roles/firebase.developAdmin`) Firebase Develop Viewer (`roles/firebase.developViewer`) Firebase Viewer (`roles/firebase.viewer`) Security Admin (`roles/iam.securityAdmin`) Security Reviewer (`roles/iam.securityReviewer`) Cloud Run Admin (`roles/run.admin`) Cloud Run Developer (`roles/run.developer`) Cloud Run Source Developer (`roles/run.sourceDeveloper`) Cloud Run Source Viewer (`roles/run.sourceViewer`) Cloud Run Viewer (`roles/run.viewer`) Service agent roles Warning: Don't grant service agent roles to any principals except service agents. Cloud Functions Service Agent (`roles/cloudfunctions.serviceAgent`)

Cloud Run roles and permissions Stay organized with collections Save and categorize content based on your preferences.

Cloud Run roles

Cloud Run Admin

Cloud Run Builder Beta

Cloud Run Developer

Cloud Run Invoker

Cloud Run Jobs Executor

Cloud Run Jobs Executor With Overrides

Cloud Run Service Agent

Cloud Run Service Invoker

Cloud Run Source Developer Beta

Cloud Run Source Viewer Beta

Cloud Run Viewer

Cloud Run Service Agent

Cloud Run permissions

run.configurations.get

run.configurations.list

run.executions.cancel

run.executions.delete

run.executions.get

run.executions.list

run.jobs.create

run.jobs.createTagBinding

run.jobs.delete

run.jobs.deleteTagBinding

run.jobs.get

run.jobs.getIamPolicy

run.jobs.list

run.jobs.listEffectiveTags

run.jobs.listTagBindings

run.jobs.run

run.jobs.runWithOverrides

run.jobs.setIamPolicy

run.jobs.update

run.locations.list

run.operations.delete

run.operations.get

run.operations.list

run.revisions.delete

run.revisions.get

run.revisions.list

run.routes.get

run.routes.invoke

run.routes.list

run.services.create

run.services.createTagBinding

run.services.delete

run.services.deleteTagBinding

run.services.get

run.services.getIamPolicy

run.services.list

run.services.listEffectiveTags

run.services.listTagBindings

run.services.setIamPolicy

run.services.update

run.tasks.get

run.tasks.list

Cloud Run roles and permissions
Stay organized with collections Save and categorize content based on your preferences.

Cloud Run Builder ^Beta

Cloud Run Source Developer ^Beta

Cloud Run Source Viewer ^Beta

`run.configurations.get`

`run.configurations.list`

`run.executions.cancel`

`run.executions.delete`

`run.executions.get`

`run.executions.list`

`run.jobs.create`

`run.jobs.createTagBinding`

`run.jobs.delete`

`run.jobs.deleteTagBinding`

`run.jobs.get`

`run.jobs.getIamPolicy`

`run.jobs.list`

`run.jobs.listEffectiveTags`

`run.jobs.listTagBindings`

`run.jobs.run`

`run.jobs.runWithOverrides`

`run.jobs.setIamPolicy`

`run.jobs.update`

`run.locations.list`

`run.operations.delete`

`run.operations.get`

`run.operations.list`

`run.revisions.delete`

`run.revisions.get`

`run.revisions.list`

`run.routes.get`

`run.routes.invoke`

`run.routes.list`

`run.services.create`

`run.services.createTagBinding`

`run.services.delete`

`run.services.deleteTagBinding`

`run.services.get`

`run.services.getIamPolicy`

`run.services.list`

`run.services.listEffectiveTags`

`run.services.listTagBindings`

`run.services.setIamPolicy`

`run.services.update`

`run.tasks.get`

`run.tasks.list`