What IAM permissions do I need for a service key that can run "gcloud builds submit" and "gcloud run deploy"?

Question

I'm trying to figure out the absolute minimum set of IAM permissions I need to assign to a service key that will be used to run the following commands:

gcloud builds submit --tag gcr.io/MYPROJECT/MYNAME
gcloud run deploy --allow-unauthenticated --platform=managed --image gcr.io/MYPROJECT/MYNAME ...

I've had a lot of trouble figuring out IAM, so the more detailed instructions anyone can give me the better!

Here's what I've figured out so far (I ended up going with way more open permissions than I wanted): https://simonwillison.net/2020/Jan/21/github-actions-cloud-run/#google-cloud-service-key

I'm actually running these commands inside a Python script - relevant code is here: https://github.com/simonw/datasette/blob/07e208cc6d9e901b87552c1be2854c220b3f9b6d/datasette/publish/cloudrun.py#L134-L141

Answer 1

I understand you are running these commands with a service account, and your goal is to determine the minimal set of IAM permissions to assign to this service account so that it can build and deploy. I am going to list a set of minimal IAM roles (not IAM permissions)

To run gcloud builds submit --tag gcr.io/MYPROJECT/MYNAME, you need:

• roles/cloudbuild.builds.editor to trigger the build
• roles/storage.admin to push te image

To run gcloud run deploy --allow-unauthenticated --platform=managed --image gcr.io/MYPROJECT/MYNAME ... you need:

• roles/run.admin (to deploy and allow allUsers to access the service)
• roles/iam.serviceAccountUser (because the code will then run under a servie account, so the service account used to deploy needs to also be able to "act as" the runtime service account)