Troubleshooting Cloud Build Nested gcloud Builds Service Account Permissions

Network Topology

A Cloud Build pipeline uses the above cloudbuild.yaml. When triggered, the deploy step fails with: 'ERROR: (gcloud.run.deploy) PERMISSION_DENIED: Permission 'run.services.update' denied on resource.' The Cloud Build service account has the 'Cloud Run Admin' role. What is the most likely cause?

Quick Answer

The answer is that the nested gcloud builds submit command runs with a different service account lacking the Cloud Run Admin role. This occurs because when Cloud Build triggers a nested build, that child process executes under the default Compute Engine service account—or a user-specified service account—rather than inheriting the top-level Cloud Build service account’s permissions. Even if the parent service account has the Cloud Run Admin role, the nested build’s service account may lack the run.services.update permission, causing the deploy step to fail with PERMISSION_DENIED. On the Google Professional Cloud DevOps Engineer exam, this scenario tests your understanding of service account propagation in multi-step pipelines, a common trap where engineers assume permissions cascade automatically. Remember the key insight: nested builds break the permission chain. Memory tip: “Nested builds need their own keys”—always verify the service account assigned to each gcloud builds submit invocation.

⚠ Common exam trap

Google Cloud often tests the misconception that all steps in a Cloud Build pipeline share the same service account, when in fact nested builds use a different service account by default, leading to unexpected permission errors.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The nested 'gcloud builds submit' command runs with a different service account that does not have the Cloud Run Admin role.

When a Cloud Build pipeline uses a nested `gcloud builds submit` command, the nested build runs under the default Compute Engine service account (or a user-specified service account) rather than the top-level Cloud Build service account. Even if the top-level service account has the Cloud Run Admin role, the nested build's service account may lack the `run.services.update` permission, causing the deploy step to fail with PERMISSION_DENIED.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The substitution variable ${_ENV} is not properly passed to the nested build.
Why it's wrong here
The substitution is used correctly; the error is not about missing variables.
✓
The nested 'gcloud builds submit' command runs with a different service account that does not have the Cloud Run Admin role.
Why this is correct
Nested builds use the default Cloud Build service account of the second build, which may lack permissions.
✗
The 'gcr.io/cloud-builders/gcloud' image does not support the 'gcloud run deploy' command.
Why it's wrong here
The image does support it; the error is permissions.
✗
The Cloud Build service account at the top level does not have the 'run.services.update' permission.
Why it's wrong here
The top-level service account has Cloud Run Admin, but the nested build uses a different identity.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on PCDOE

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A team uses Cloud Build to deploy a Cloud Run service. The build fails with: 'ERROR: (gcloud.run.services.update) PERMISSION_DENIED: Permission 'run.services.update' denied on resource.' The Cloud Build service account has the Cloud Run Admin role. What is missing?

easy

✓ A.The build config must use the Cloud Run deployer step instead of the gcloud command.
B.The Cloud Build service account should have the Owner role on the project.
C.The Cloud Run service must be deployed in the same region as the build.
D.The Cloud Build service account needs the 'run.services.update' permission or the Cloud Run Admin role.

Why A: The error occurs because using the gcloud command directly in a Cloud Build step does not automatically handle IAM permissions as the Cloud Run deployer step does. Although the Cloud Build service account has the Cloud Run Admin role, the gcloud command may fail due to missing resource-level permissions or because it uses a different service account context. The Cloud Run deployer step is designed to properly authenticate and apply the necessary permissions for deploying to Cloud Run.

Last reviewed: Jun 30, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This PCDOE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCDOE exam.