[Cloud Run] Permission denied editing, deploying source

[marketong]

Since Google cloud changed Cloud Run Function to Cloud Run this week, our team members suddenly cannot edit and deploy any function

Could anybody suggest which role I have to grant for?

This is current role on IAM permission :

[DamianS · Accepted solution]

Hello @marketong  ,Welcome on Google Cloud Community.
Did you've checked following IAM roles:

- (roles/run.admin) Full control over all Cloud Run resources.
- (roles/run.builder) Can build Cloud Run functions and source deployed services.
- (roles/run.developer) Read and write access to all Cloud Run resources.

More info about Clod Run roles: https://cloud.google.com/run/docs/reference/iam/roles#additional-configuration 
Permissions that you need to deploy services or revisions: 

• Cloud Run Developer (roles/run.developer) on the Cloud Run service
• Artifact Registry Reader (roles/artifactregistry.reader) on the Artifact Registry repository of the container images of the service
• Service Account User (roles/iam.serviceAccountUser) on the Cloud Run service identity

Also, you can check IAM errors related with lack of permissions via Logs Explorer. 

--
cheers,
Damian Sztankowski
LinkedIn medium.com Cloudskillsboost Sessionize Youtube

[DamianS · Accepted solution]

Hello @marketong  ,Welcome on Google Cloud Community.
Did you've checked following IAM roles:

- (roles/run.admin) Full control over all Cloud Run resources.
- (roles/run.builder) Can build Cloud Run functions and source deployed services.
- (roles/run.developer) Read and write access to all Cloud Run resources.

More info about Clod Run roles: https://cloud.google.com/run/docs/reference/iam/roles#additional-configuration 
Permissions that you need to deploy services or revisions: 

• Cloud Run Developer (roles/run.developer) on the Cloud Run service
• Artifact Registry Reader (roles/artifactregistry.reader) on the Artifact Registry repository of the container images of the service
• Service Account User (roles/iam.serviceAccountUser) on the Cloud Run service identity

Also, you can check IAM errors related with lack of permissions via Logs Explorer. 

--
cheers,
Damian Sztankowski
LinkedIn medium.com Cloudskillsboost Sessionize Youtube

[ronnelg · Accepted solution]

Hi @marketong, 

In addition to @DamianS response, you can try to follow this guide before you begin to deploy functions in Cloud Run. Make sure that you enable the Cloud Run Admin API and have the Cloud Run Source Developer (roles/run.sourceDeveloper) role.

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.