IssueTracker

Passing in a --build-service-account to override the Compute Engine default service account results in the following error regardless of permissions granted:

ERROR: (gcloud.run.deploy) PERMISSION_DENIED: Build failed due to missing permission. Please check that you are using the correct service account in the format `projects/{PROJECT_ID}/serviceAccounts/{SERVICE_ACCOUNT_EMAIL}`.

I am trying to follow the Quickstart: Build and deploy a Python web app to Cloud Run guide so the container in question is the copy/pasted Flask server in those docs.

CLI command failing:

gcloud run deploy helloworld \
    --source ./helloworld \
    --region us-east4 \
    --allow-unauthenticated \
    --service-account="projects/<PROJECT_ID>/serviceAccounts/<SERVICE_ACCOUNT_EMAIL>" \
    --build-service-account="projects/<PROJECT_ID>/serviceAccounts/<SERVICE_ACCOUNT_EMAIL>" \
    --verbosity=debug

The service account I'm testing has the following (absurd) list of IAM permissions:

• Owner
• Artifact Registry Writer
• Cloud Build Service Account
• Cloud Deploy Releaser
• Cloud Run Admin
• Cloud Run Builder
• Cloud Run Developer
• Service Account User

Additionally, the docs fail to mention the required format for the Service Accounts. just passing in the service account email will result in a regex match error.