Cloud Run Deploy Permission Denied (iam.serviceaccounts.actAs)

How to fix it

Try these in order — the most common fix is first.

1. 1. actAs denied on the default Compute Engine account

   Copy steps
   1. Run gcloud run services update SERVICE_NAME --service-account SERVICE_ACCOUNT
   2. Confirm the service account has the permissions needed to deploy
   3. Check IAM with Include Google-provided role grants for PROJECT_NUMBER-compute@developer.gserviceaccount.com
   Did this fix it? Yes No

2. 2. Grant Service Account User

   Copy steps
   1. Grant roles/iam.serviceAccountUser to the deployer on the service identity
   2. If same project, give the Cloud Run service agent roles/run.serviceAgent
   Did this fix it? Yes No

3. 3. Source deploy errors

   Copy steps
   1. Grant roles/run.sourceDeveloper, roles/serviceusage.serviceUsageConsumer and roles/iam.serviceAccountUser
   2. For NOT_FOUND: Build failed in new projects, grant the build service account roles/run.builder
   Did this fix it? Yes No

4. 4. Image in another project

   Copy steps
   1. Let the Cloud Run service agent read the image (grant access in the image's project)
   2. If using VPC Service Controls, check Logs Explorer for violations tied to serverless-robot-prod
   Did this fix it? Yes No

5. 5. Wait and retry

   1. IAM changes can take a few minutes to apply
   Did this fix it? Yes No

Symptoms

gcloud run deploy fails with PERMISSION_DENIED, Permission 'iam.serviceaccounts.actAs' denied, or the caller does not have permission.

Why it happens

• Deployer lacks Service Account User on the runtime service account
• Default Compute Engine service account missing or not usable
• Cloud Run service agent cannot read an image from another project
• Missing source deploy roles
• Cloud Build default service account changes in new projects
• Cross-project deploy blocked by org policy

This guide also covers

• cloud run deploy permission denied
• iam.serviceaccounts.actAs denied
• gcloud run deploy the caller does not have permission

The same problem in other apps

All export, render & quality loss guides →

• DigitalOcean App Platform Build Failed (DigitalOcean)
• Render Free Instance Spins Down: Slow First Request (Render)
• Fly.io Deploy Failed: Waiting for Depot Builder, Registry 401, Too Many Requests (Fly.io)

Other Google Cloud errors

• Google Cloud Billing Account Suspended
• Google Cloud Unexpected Charges: Why Is My GCP Bill So High?
• Google Cloud Quota Exceeded Error
• Cloud Run: Container Failed to Start and Listen on PORT
• Google Cloud PERMISSION_DENIED 403 Error
• Google Cloud Free Trial Ended: What Happens and What to Do
• How to Cancel Google Cloud (Close Billing Account)