Google Cloud Run Deploy error: Missing necessary permission error

0
votes

When trying to deploy my container (or the hello world container) to google cloud run I receive this error:

ERROR: (gcloud.run.deploy) Cloud Run error: Internal system error. Missing necessary permission for service-<ID>@serverless-robot-prod.iam.gserviceaccount.com on resource <PROJECT ID>

I can see that the service account mentioned in the error is in my IAM dashboard and has the Google Cloud Run Service Agent role. I even tried giving it the Owner role, but it didn't work.

I tried including the --service-account flag with the same service account and receive this error:

PERMISSION_DENIED: Permission 'iam.serviceaccounts.actAs' denied on service account service-<ID>@serverless-robot-prod.iam.gserviceaccount.com (or it may not exist).

Which I know doesn't make sense.

I also tried this deploy through the console ui, but received the same error (the first one).

How do I fix this permission error?

2
google-cloud-run
There was an outage around the time you asked this question affecting IAM permissions, does this work now? - Dustin Ingram
Yep it works now! - babaloo
I'm voting to close this question as off-topic because transient issue. - Ahmet Alp Balkan

2 Answers

1
votes

I order to assign the iam.serviceAccounts.actAs permission you have to set the roles/iam.serviceAccountUser role.

You can do this by going to the Console > IAM & Admin and setting the Service Account User role to your service account.

Also, confirm that the Cloud Run runtime service account also has the iam.serviceAccounts.actAs permission. This is a requirement specified in the Cloud Run deployment permissions docs

1
votes

As Dustin mentioned, there was an outage affecting IAM permissions. Now that the outage has been resolved, my deployment is working!