Stay organized with collections
Save and categorize content based on your preferences.
During source deployments, Cloud Run leverages Cloud Build
when building and deploying your Cloud Run service.
This page shows how to set a
user-specified service account
for Cloud Build to use when executing builds of the service on your behalf.
This guide is relevant for platform developers who are deploying
Cloud Run services or
functions using the Google Cloud CLI and need to
customize the build service account used by Cloud Build. The build service
account gcloud CLI flag is supported for
source deployments (--source), and not
supported for container image deployments (--image).
Before you begin
Enable the Cloud Build API:
gcloudservicesenablecloudbuild.googleapis.com
Create a service account, or have an
existing service account, to use as the Cloud Build service
account.
Required roles
You or your administrator must grant the deployer account and the
Cloud Build service account the following IAM roles.
Click to view required roles for the deployer account
To get the permissions that you need to build and deploy from source,
ask your administrator to grant you the following IAM
roles:
Service Account User (roles/iam.serviceAccountUser) on the Cloud Run service identity
Click to view required roles for the Cloud Build service account
To allow the Cloud Build service account to perform the build
when deploying a function, ask your administrator to grant the
Cloud Run Builder
(roles/run.builder) role to the Cloud Build service
account on the project.
As a best practice for following the principle of least privilege to improve the
security posture of your service, we recommend that you specify your own service
account to run your builds when deploying a service from source.
gcloud
To specify the Cloud Build service account when deploying a
service from source code, use the --build-service-account flag:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-28 UTC."],[],[],null,["# Set build service account (source deploy)\n\nDuring source deployments, Cloud Run leverages Cloud Build\nwhen building and deploying your Cloud Run service.\n\nThis page shows how to set a\n[user-specified service account](/build/docs/cloud-build-service-account#user_access_to_triggers)\nfor Cloud Build to use when executing builds of the service on your behalf.\nThis guide is relevant for platform developers who are deploying\nCloud Run [services](/run/docs/deploying-source-code) or\n[functions](/run/docs/deploy-functions) using the Google Cloud CLI and need to\ncustomize the build service account used by Cloud Build. The build service\naccount gcloud CLI flag is supported for\n[source deployments](/run/docs/deploying-source-code) (`--source`), and not\nsupported for [container image deployments](/run/docs/deploying) (`--image`).\n\nBefore you begin\n----------------\n\n1. Enable the Cloud Build API:\n\n ```bash\n gcloud services enable cloudbuild.googleapis.com\n ```\n2. [Create a service account](/iam/docs/service-accounts-create), or have an\n existing service account, to use as the Cloud Build service\n account.\n\n### Required roles\n\nYou or your administrator must grant the deployer account and the\nCloud Build service account the following IAM roles. \n\n#### Click to view required roles for the deployer account\n\nTo get the permissions that you need to build and deploy from source,\nask your administrator to grant you the following IAM\nroles:\n\n- [Cloud Run Source Developer](/iam/docs/understanding-roles#run.sourceDeveloper) (`roles/run.sourceDeveloper`) on your project\n- [Service Usage Consumer](/iam/docs/understanding-roles#serviceusage.serviceUsageConsumer) (`roles/serviceusage.serviceUsageConsumer`) on your project\n- [Service Account User](/iam/docs/understanding-roles#iam.serviceAccountUser) (`roles/iam.serviceAccountUser`) on the Cloud Run service identity \n\n#### Click to view required roles for the Cloud Build service account\n\nTo allow the Cloud Build service account to perform the build\nwhen deploying a function, ask your administrator to grant the\n[Cloud Run Builder](/iam/docs/understanding-roles#run.builder)\n(`roles/run.builder`) role to the Cloud Build service\naccount on the project.\n| **Note:** If you need to use a service account from a different project, you or your administrator must grant additional access to the service account. See [Cross-project set up](/build/docs/securing-builds/configure-user-specified-service-accounts#cross-project_set_up) for more details.\n\nFor a list of IAM roles and permissions that are associated with\nCloud Run, see\n[Cloud Run IAM roles](/run/docs/reference/iam/roles)\nand [Cloud Run IAM permissions](/run/docs/reference/iam/permissions).\nIf your Cloud Run service interfaces with\nGoogle Cloud APIs, such as Cloud Client Libraries, see the\n[service identity configuration guide](/run/docs/configuring/services/service-identity).\nFor more information about granting roles, see\n[deployment permissions](/run/docs/reference/iam/roles#additional-configuration)\nand [manage access](/iam/docs/granting-changing-revoking-access).\n\nSpecify a Cloud Build service account\n-------------------------------------\n\nBy default, if a Cloud Build service account isn't specified when\ndeploying a [service](/run/docs/deploying-source-code) or\n[function](/run/docs/deploy-functions#gcloud_1) from source,\nCloud Build uses the\n[default Cloud Build service account](/build/docs/cloud-build-service-account).\n\nAs a best practice for following the principle of least privilege to improve the\nsecurity posture of your service, we recommend that you specify your own service\naccount to run your builds when deploying a service from source. \n\n### gcloud\n\nTo specify the Cloud Build service account when deploying a\nservice from source code, use the `--build-service-account` flag: \n\n```bash\ngcloud run deploy SERVICE \\\n --source . \\\n --build-service-account projects/PROJECT_ID/serviceAccounts/BUILD_SERVICE_ACCOUNT\n```\n\nReplace:\n\n- \u003cvar translate=\"no\"\u003eSERVICE\u003c/var\u003e with name of your Cloud Run service.\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e the project ID where the build service account is created.\n- \u003cvar translate=\"no\"\u003eBUILD_SERVICE_ACCOUNT\u003c/var\u003e with a user-specified service account.\n\nIf you are deploying a function, add the `--function` flag with the function\nentry point from your source code."]]
