How to fix Error: Error creating Cloud Run Service: PermissionDenied in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 31, 2025· 103 views

When deploying Cloud Run services with Terraform, a PermissionDenied error occurs because the Terraform service account or Cloud Run Service Agent lacks required IAM roles. This prevents Terraform from creating or updating Cloud Run services.

Quick fix

Fixes Error: Error creating Cloud Run Service: PermissionDenied

provider "google" {
  credentials = file("path/to/service-account-key.json")
  project     = "your-gcp-project-id"
  region      = "us-central1"
}
  1. Verify Terraform provider credentials configuration
  2. Grant Cloud Run Admin role to Terraform service account
  3. Grant IAM Service Account User role
  4. Ensure Cloud Run Service Agent has correct role
terraform — error
provider "google" {
  credentials = file("path/to/service-account-key.json")
  project     = "your-gcp-project-id"
  region      = "us-central1"
}
Error: Error creating Cloud Run Service: PermissionDenied

What this error means

This error indicates that the authenticated identity (your Terraform service account) does not have sufficient permissions to create or manage Cloud Run services in your GCP project. The error typically stems from missing IAM roles on either the Terraform execution account or the Cloud Run Service Agent. GCP uses Identity and Access Management (IAM) to control access to resources, and attempting operations without the required roles triggers this permission denied response.

Typical symptoms

  • Terraform apply fails during google_cloud_run_v2_service or google_cloud_run_service resource creation
  • Error message explicitly mentions PermissionDenied when attempting to create Cloud Run services
  • Service deployment works via gcloud CLI but fails in Terraform
  • Partial infrastructure is created (some resources succeed but Cloud Run creation fails)

Common causes

  1. Terraform service account lacks roles/run.admin or basic roles like roles/editor
  2. Cloud Run Service Agent (service-[PROJECT_NUMBER]@serverless-robot-prod.iam.gserviceaccount.com) does not have the roles/run.serviceAgent role
  3. Service account used for Cloud Run does not have iam.serviceAccounts.getAccessToken permission
  4. Required Google APIs (Cloud Run, Cloud Resource Manager, IAM) are not enabled on the project
  5. IAM role propagation delay after newly creating a service account (transient issue)

How to fix "Error: Error creating Cloud Run Service: PermissionDenied"

1Verify Terraform provider credentials configuration

Check your Terraform provider block to ensure it references the correct credentials file and project ID:

hcl
provider "google" {
  credentials = file("path/to/service-account-key.json")
  project     = "your-gcp-project-id"
  region      = "us-central1"
}

Confirm the service account key file exists and is valid.

2Grant Cloud Run Admin role to Terraform service account

Use the gcloud CLI to grant the Terraform service account the Cloud Run Admin role:

bash
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:terraform-sa@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/run.admin"

Replace terraform-sa@YOUR_PROJECT_ID.iam.gserviceaccount.com with your actual Terraform service account email.

3Grant IAM Service Account User role

The Terraform service account must be able to use the Cloud Run service account. Grant this permission:

bash
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:terraform-sa@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountUser"

This allows Terraform to deploy services that use service accounts.

4Ensure Cloud Run Service Agent has correct role

Grant the Cloud Run Service Agent the required roles/run.serviceAgent role:

bash
PROJECT_NUMBER=$(gcloud projects describe YOUR_PROJECT_ID --format='value(projectNumber)')

gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:service-${PROJECT_NUMBER}@serverless-robot-prod.iam.gserviceaccount.com" \
  --role="roles/run.serviceAgent"

This gives the Cloud Run system the permissions it needs to manage services.

5Enable required Google APIs

Ensure the necessary APIs are enabled on your GCP project:

bash
gcloud services enable run.googleapis.com \
  cloudresourcemanager.googleapis.com \
  iam.googleapis.com \
  YOUR_PROJECT_ID

The Cloud Run API, Cloud Resource Manager API, and IAM API must be active for Terraform operations.

6Retry Terraform apply and allow IAM propagation time

After granting roles, wait 10-30 seconds for IAM changes to propagate across GCP systems, then retry:

bash
terraform apply

If the error persists, roles may still be propagating. Wait a minute and try again. If it continues to fail, verify all roles were granted to the correct service accounts using:

bash
gcloud projects get-iam-policy YOUR_PROJECT_ID --flatten="bindings[].members"

Advanced notes

For service accounts created recently, IAM permission propagation can cause transient 403 errors. These typically resolve after waiting 30-60 seconds and retrying. If you are deploying a Cloud Run service that accesses other GCP resources (Cloud SQL, Secrets Manager, Cloud Storage), ensure the Cloud Run service account (not the Terraform account) has the appropriate roles on those resources. Use the google_cloud_run_service_iam_binding resource in Terraform to manage who can invoke your service. When using service account impersonation in Terraform, ensure the impersonating account has the roles/iam.serviceAccountTokenCreator role.

Frequently asked questions

What does "Error: Error creating Cloud Run Service: PermissionDenied" mean?
This error indicates that the authenticated identity (your Terraform service account) does not have sufficient permissions to create or manage Cloud Run services in your GCP project. The error typically stems from missing IAM roles on either the Terraform execution account or the Cloud Run Service Agent. GCP uses Identity and Access Management (IAM) to control access to resources, and attempting operations without the required roles triggers this permission denied response.
How do I fix "Error: Error creating Cloud Run Service: PermissionDenied"?
When deploying Cloud Run services with Terraform, a PermissionDenied error occurs because the Terraform service account or Cloud Run Service Agent lacks required IAM roles. This prevents Terraform from creating or updating Cloud Run services.
What causes "Error: Error creating Cloud Run Service: PermissionDenied"?
Terraform service account lacks roles/run.admin or basic roles like roles/editor Cloud Run Service Agent (service-[PROJECT_NUMBER]@serverless-robot-prod.iam.gserviceaccount.com) does not have the roles/run.serviceAgent role Service account used for Cloud Run does not have iam.serviceAccounts.getAccessToken permission
Is the "Error: Error creating Cloud Run Service: PermissionDenied" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading