Configure service identity for jobs

Console

1. In the Google Cloud console, go to the Cloud Run Jobs page:

   Go to Cloud Run

2. Click Deploy container to fill out the initial job settings page. If you are configuring an existing job, select the job, then click View and edit job configuration.

3. Click Containers, Connections, Security to expand the job properties page.

4. Click the Security tab.

   

   • Click the Service account dropdown and select an existing service account, or click Create a new service account if applicable.

5. Click Create or Update.

gcloud run jobs create JOB_NAME --service-account SERVICE_ACCOUNT

gcloud run jobs update JOB_NAME --image IMAGE_URL --service-account SERVICE_ACCOUNT

resource "google_cloud_run_v2_job" "default" {
  name     = "JOB_NAME"
  location = "REGION"

  template {
    template {
      containers {
        image = "us-docker.pkg.dev/cloudrun/container/job"
        }
      service_account = "SERVICE_ACCOUNT"
      }
    }
  }

Use service accounts in other projects

If you configure a service account from a different Google Cloud project than the Cloud Run resource, do the following:

1. You or your administrator must grant the Service Account User role (roles/iam.serviceAccountUser) on the service account that you use as the service identity.

   Console

   1. Go to the Service accounts page of the Google Cloud console:

      Go to Service accounts

   2. Select the service account email address you are using as the service identity.

   3. Click the Principals with access tab.

   4. Click the person_add Grant access button.

   5. Enter the deployer account email address that matches the principal you're granting the Admin or Developer role to.

   6. In the Select a role drop-down, select the Service Accounts > Service Account User role.

   7. Click Save.

   gcloud

   Use the gcloud iam service-accounts add-iam-policy-binding command, replacing the highlighted variables with the appropriate values:

   gcloud iam service-accounts add-iam-policy-binding \
       SERVICE_ACCOUNT_NAME@SERVICE_ACCOUNT_PROJECT_ID.iam.gserviceaccount.com \
       --member="PRINCIPAL" \
       --role="roles/iam.serviceAccountUser"

   Replace the following:

   • SERVICE_ACCOUNT_NAME: the name of the service account that you are attaching the Cloud Run resource to
   • SERVICE_ACCOUNT_PROJECT_ID: the project ID where the service account is located

   • PRINCIPAL: the deployer account you are adding the binding for, using the format user|group|serviceAccount:email or domain:domain—for example:

     • user:test-user@gmail.com
     • group:admins@example.com
     • serviceAccount:test123@example.domain.com
     • domain:example.domain.com

2. You or your administrator must grant the Cloud Run resource's service agent the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the service account you use as the service identity. The service agent follows the format of service-PROJECT_NUMBER@serverless-robot-prod.iam.gserviceaccount.com.

   Console

   1. Go to the Service accounts page of the Google Cloud console:

      Go to Service accounts

   2. Select the service account email address you are using as the service identity.

   3. Click the Permissions tab.

   4. Click the person_add Grant access button.

   5. Enter the service agent email address. For example: service-PROJECT_NUMBER@serverless-robot-prod.iam.gserviceaccount.com.

   6. In the Select a role drop-down, select the Service Accounts > Service Account Token Creator role.

   7. Click Save.

   gcloud

   Use the gcloud iam service-accounts add-iam-policy-binding command:

   gcloud iam service-accounts add-iam-policy-binding \
       SERVICE_ACCOUNT_NAME@SERVICE_ACCOUNT_PROJECT_ID.iam.gserviceaccount.com \
       --member="serviceAccount:service-CLOUD_RUN_RESOURCE_PROJECT_NUMBER@serverless-robot-prod.iam.gserviceaccount.com" \
       --role="roles/iam.serviceAccountTokenCreator"

   Replace the following:

   • SERVICE_ACCOUNT_NAME: the name of the service account that you are attaching the Cloud Run resource to
   • SERVICE_ACCOUNT_PROJECT_ID: the project ID where the service account is located
   • CLOUD_RUN_RESOURCE_PROJECT_NUMBER: the project number where the Cloud Run is located

   The command prints the updated allow policy for the user-managed service account.

3. The project containing this service account requires the org-policy iam.disableCrossProjectServiceAccountUsage to be set to false or unenforced at the folder level or inherited from project-level settings. By default, this is set to true.

   Console

   1. Go to the Organization policies page in the Google Cloud console:

      Go to Organization policies

   2. From the project picker, select the organization and project for which you want to disable cross-project service account usage for.

   3. Select the disable cross-project service account usage policy.

   4. Click Manage policy.

   5. Under Policy source, select Override parent's policy.

   6. Click Add a rule.

   7. Under Enforcement, select Off.

   8. To enforce the policy, click Set policy.

   gcloud

   In the project that has the service account, ensure that the iam.disableCrossProjectServiceAccountUsage organization policy constraint is not enforced. This constraint is enforced by default.

   To disable this organization policy constraint, run:

   gcloud resource-manager org-policies disable-enforce iam.disableCrossProjectServiceAccountUsage
       --project=SERVICE_ACCOUNT_PROJECT_ID

   Replace SERVICE_ACCOUNT_PROJECT_ID with the project ID that contains the service account.

You can apply role memberships directly to the service account resource or inherit from higher levels in the resource hierarchy.

What's next

• For more information about service accounts, see the IAM service account and user-managed service account guides.
• If your Cloud Run service, job, or worker pool accesses Google APIs or Google Cloud services, you must configure your service account as the service identity. Learn more.