hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A Cloud Build pipeline builds a container image…
A Cloud Build pipeline builds a container image and pushes it to Artifact Registry. The next step needs to deploy the image to Cloud Run. The pipeline runs as the Cloud Build service account. What minimum permission does the Cloud Build SA need for the deployment step?
⚠ Common exam trap
Google Cloud often tests the nuance that deploying to Cloud Run requires not just Cloud Run permissions but also the ability to impersonate the runtime service account, leading candidates to incorrectly choose `roles/run.admin` alone.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
`roles/run.admin` and `roles/iam.serviceAccountUser` on the Cloud Run runtime service account.
The Cloud Build service account needs `roles/run.admin` to deploy services to Cloud Run, but it also requires `roles/iam.serviceAccountUser` on the Cloud Run runtime service account (the identity the Cloud Run service runs as) because the deployment step impersonates that runtime service account to create or update the service. Without the `iam.serviceAccountUser` permission, the deployment fails with a permission denied error, even if the Cloud Build SA has full Cloud Run admin rights.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
`roles/run.admin` only.
Why it's wrong here
`roles/run.admin` alone is insufficient because it only covers management of Cloud Run services (e.g., creating revisions, updating configs) but does NOT include the `iam.serviceAccounts.actAs` permission. Without that `actAs` permission (granted via `roles/iam.serviceAccountUser`), the Cloud Build service account cannot specify or impersonate the runtime service account when deploying a Cloud Run revision, so the deployment will fail with a permission denied error. This is why both roles are required for a successful Cloud Build-to-Cloud Run deployment.
- ✓
`roles/run.admin` and `roles/iam.serviceAccountUser` on the Cloud Run runtime service account.
Why this is correct
This is correct because Cloud Build's service account needs two distinct permissions to deploy to Cloud Run: `roles/run.admin` to create, update, and manage the Cloud Run service and its revisions, and `roles/iam.serviceAccountUser` granted on the runtime service account itself. The `iam.serviceAccountUser` role includes the `iam.serviceAccounts.actAs` permission, which allows the Cloud Build SA to specify that runtime SA when creating or updating a Cloud Run service. This pairing follows least privilege by giving exactly the permissions needed, no more.
- ✗
`roles/owner` to ensure all necessary permissions are covered.
Why it's wrong here
Granting `roles/owner` is technically overly broad and a least-privilege violation. The Owner role includes every permission in the project, including IAM management, billing, and all resource administration, far beyond what is needed for Cloud Run deployment. While Owner would functionally cover both `run.admin` and `iam.serviceAccounts.actAs`, it exposes the project to far greater risk if the Cloud Build SA is compromised; the narrowly scoped `roles/run.admin` plus `roles/iam.serviceAccountUser` on the runtime service account is the correct, secure approach.
- ✗
`roles/cloudbuild.builds.editor` on the Cloud Run project.
Why it's wrong here
`roles/cloudbuild.builds.editor` grants permissions to create and manage Cloud Build resources (such as builds and triggers), but it does NOT grant any permissions on Cloud Run services or on service accounts. This role cannot create or update a Cloud Run service, nor can it act as the runtime service account during deployment. Cloud Build's own service account already has permission to execute builds; to deploy to Cloud Run, that SA needs the distinct Cloud Run and service-account-impersonation IAM roles, not the build editor role.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
Container
A container is a lightweight, standalone software package that includes everything needed to run an application, such as code, runtime, system tools, and libraries.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.