Cloud Run "Permission 'run.services.create' denied" in CI

gcloud authenticated successfully, but the service account it used has no IAM permission to create or update a Cloud Run service in the target project. The API rejects the deploy with run.services.create denied.

What this error means

gcloud run deploy fails with "PERMISSION_DENIED: Permission 'run.services.create' denied on resource ... (or it may not exist)". Authentication worked; authorization did not.

ERROR: (gcloud.run.deploy) PERMISSION_DENIED: Permission 'run.services.create' denied
on resource 'namespaces/my-project/services/api' (or resource may not exist).

Common causes

The CI service account lacks Cloud Run Admin

Deploying a service needs roles/run.admin (or an equivalent custom role). A read-only or narrowly scoped account cannot call run.services.create.

Acting on the wrong project

The active project does not match where the account has permissions, so the resource "may not exist" from its point of view.

How to fix it

Grant the Cloud Run Admin role

1. Identify the service account CI authenticates as.
2. Bind roles/run.admin to it on the target project.
3. Also grant roles/iam.serviceAccountUser so it can act as the runtime service account.

gcloud projects add-iam-policy-binding my-project \
  --member="serviceAccount:ci@my-project.iam.gserviceaccount.com" \
  --role="roles/run.admin"

Confirm the active project and identity

Make sure the deploy targets the project where the role was granted, and that the expected account is active.

gcloud config get-value project
gcloud auth list --filter=status:ACTIVE --format="value(account)"

How to prevent it

• Grant roles/run.admin plus roles/iam.serviceAccountUser to the deploy identity up front.
• Pin the project explicitly with --project on the deploy command.
• Use Workload Identity Federation so CI assumes a least-privilege deploy account.

Related guides