If you are creating a new function, see the Console Quickstart on Cloud Run.

Access control with IAM

This page provides supplemental information for using Identity and Access Management (IAM) roles to set access controls at a project level, to determine the level of access to your Google Cloud project and functions created using gcloud functions commands or the Cloud Functions v2 API.

If you've created or deployed functions using Cloud Run, see Access control with IAM and Cloud Run roles for a detailed description of Cloud Run predefined roles, controlling access to individual services, making a service public, or configuring organization policy for the Cloud Run invoker IAM.

Access control for users

Add users as team members to your project and grant them roles using IAM.

Cloud Run functions supports the following roles:

Cloud Run predefined roles (recommended)
Cloud Functions predefined roles
Basic roles of Editor, Owner, and Viewer.

Access control for service accounts

A service account is a special type of Google Cloud account that acts as an identity for a non-human user that needs to authenticate and be authorized to access data and perform various actions. Some of these accounts are created and managed by Google itself and are known as service agents.

The following service accounts are used for Cloud Run functions:

Name	Member ID	Role
Compute Engine default service account	`PROJECT_NUMBER-compute@developer.gserviceaccount.com`	Editor
Google Cloud Functions Service Agent	`service-PROJECT_NUMBER@gcf-admin-robot.iam.gserviceaccount.com`	Google Cloud Functions Service Agent
Legacy Cloud Build service account¹	`PROJECT_NUMBER@cloudbuild.gserviceaccount.com`	Cloud Build Service Account
Cloud Build Service Account	`service-PROJECT_NUMBER@gcp-sa-cloudbuild.iam.gserviceaccount.com`	Cloud Build Service Agent
Google Container Registry Service Agent	`service-PROJECT_NUMBER@containerregistry.iam.gserviceaccount.com`	Container Registry Service Agent
Artifact Registry Service Agent	`service-PROJECT_NUMBER@gcp-sa-artifactregistry.iam.gserviceaccount.com`	Artifact Registry Service Agent

Note:

The iam.automaticIamGrantsForDefaultServiceAccounts organization policy constraint prevents the Editor role from being automatically granted to default service accounts. If you created your organization after May 3, 2024, this constraint is enforced by default.

We strongly recommend that you enforce this constraint to disable the automatic role grant. If you disable the automatic role grant, you must decide which roles to grant to the default service accounts, and then grant these roles yourself.

If the default service account already has the Editor role, we recommend that you replace the Editor role with less permissive roles.To safely modify the service account's roles, use Policy Simulator to see the impact of the change, and then grant and revoke the appropriate roles.

Runtime service accounts

At runtime, Cloud Run functions defaults to using the Compute Engine default service account (PROJECT_NUMBER-compute@developer.gserviceaccount.com), which also has the Editor role on the project. You can change the roles of these service accounts to limit or extend the permissions for your running functions. You can also change which service account is used by avoiding the default service account when configuring service identity.

To learn more about service accounts, see the service accounts documentation.

Administrative service accounts

To perform administrative actions on your project during the creation, updating, or deletion of functions, all projects in Cloud Run functions require the Google Cloud Functions Service Agent service account (service-PROJECT_NUMBER@gcf-admin-robot.iam.gserviceaccount.com).

In addition, all runtimes carry out container image building and storage within your project. To support this, you also need to provision the following:

The legacy Cloud Build service account¹ (PROJECT_NUMBER@cloudbuild.gserviceaccount.com)
The Cloud Build Service Agent service account (service-PROJECT_NUMBER@gcp-sa-cloudbuild.iam.gserviceaccount.com)
The Google Container Registry Service Agent service account (service-PROJECT_NUMBER@containerregistry.iam.gserviceaccount.com)

These service accounts should have the roles listed in the earlier table.

Google Cloud Functions Service Agent service account

By default, the Google Cloud Functions Service Agent service account (service-PROJECT_NUMBER@gcf-admin-robot.iam.gserviceaccount.com has the cloudfunctions.serviceAgent role on your project.