このページでは、Identity and Access Management（IAM）ロールを使用してプロジェクト レベルでアクセス制御を設定し、gcloud functions コマンドまたは Cloud Functions v2 API を使用して作成された Google Cloud プロジェクトと関数へのアクセスレベルを決定する方法について補足情報を提供します。
Cloud Run を使用して関数を作成またはデプロイした場合は、IAM によるアクセス制御と Cloud Run のロールで、Cloud Run の事前定義ロール、個々のサービスへのアクセス制御、サービスの公開、Cloud Run 呼び出し元 IAM の組織のポリシーの構成について詳しく説明しています。
サービス アカウントは特別なタイプのGoogle Cloud アカウントであり、データにアクセスしてさまざまなアクションを実行するために認証を受ける必要がある人間以外のユーザーの ID として機能します。これらのアカウントの一部は Google によって作成、管理され、サービス エージェントと呼ばれます。
関数の作成、更新、または削除中にプロジェクトの管理アクションを実行するには、Cloud Run functions のすべてのプロジェクトに Google Cloud Functions サービス エージェントのサービス アカウント（service-PROJECT_NUMBER@gcf-admin-robot.iam.gserviceaccount.com）が必要です。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-08-19 UTC。"],[[["\u003cp\u003eCloud Run functions access control is managed through Identity and Access Management (IAM) roles, which can be set at the project level to determine the access level for project members and service accounts.\u003c/p\u003e\n"],["\u003cp\u003eBasic roles like \u003cstrong\u003eEditor\u003c/strong\u003e, \u003cstrong\u003eOwner\u003c/strong\u003e, and \u003cstrong\u003eViewer\u003c/strong\u003e provide varying levels of read and write access to functions and other project resources, whereas the predefined \u003cstrong\u003eDeveloper\u003c/strong\u003e and \u003cstrong\u003eViewer\u003c/strong\u003e roles specifically control access to only functions-related resources.\u003c/p\u003e\n"],["\u003cp\u003eService accounts, including Google-managed service agents, are essential for Cloud Run functions, and the Compute Engine default service account is used as the default runtime service account with the \u003cstrong\u003eEditor\u003c/strong\u003e role, although this can be changed.\u003c/p\u003e\n"],["\u003cp\u003eThe Google Cloud Run functions Service Agent (\u003ccode\u003eservice-PROJECT_NUMBER@gcf-admin-robot.iam.gserviceaccount.com\u003c/code\u003e) is a critical service account that requires the \u003cstrong\u003ecloudfunctions.serviceAgent\u003c/strong\u003e role to perform administrative tasks, including the creation, updating, and deletion of functions.\u003c/p\u003e\n"],["\u003cp\u003eTroubleshooting permission errors often involves verifying that the user has the correct roles (\u003cstrong\u003eEditor\u003c/strong\u003e, \u003cstrong\u003eOwner\u003c/strong\u003e, or \u003cstrong\u003eCloud Run functions Developer\u003c/strong\u003e) and that the Cloud Run functions Service Agent has the \u003cstrong\u003ecloudfunctions.serviceAgent\u003c/strong\u003e role, as well as checking for trigger source permissions.\u003c/p\u003e\n"]]],[],null,["# Access control with IAM\n=======================\n\n\u003cbr /\u003e\n\n|\n| **Note:**\n| This content applies only to Cloud Run functions---formerly Cloud Functions (2nd gen).\n|\n| For the 1st gen version of this document, see\n| [Access control with IAM (1st gen)](/functions/1stgendocs/concepts/iam).\n\nThis page provides supplemental information for using Identity and Access Management (IAM)\nroles to set access controls at a project level, to determine the level of\naccess to your Google Cloud project and functions created using\n[`gcloud functions`](/sdk/gcloud/reference/functions) commands or the\n[Cloud Functions v2 API](/functions/docs/reference/rest).\n\nIf you've created or deployed functions using Cloud Run, see\n[Access control with IAM](/run/docs/securing/managing-access)\nand [Cloud Run roles](/run/docs/reference/iam/roles) for a detailed description of Cloud Run predefined roles,\ncontrolling access to individual services, making a service public,\nor configuring organization policy for the Cloud Run invoker\nIAM.\n\nAccess control for users\n------------------------\n\nAdd users as team members to your project and grant them roles using\n[IAM](/iam/docs/overview).\n\nCloud Run functions supports the following roles:\n\n- Cloud Run predefined roles (recommended)\n- [Cloud Functions predefined roles](/iam/docs/understanding-roles#cloud-functions-roles)\n- [Basic roles](/iam/docs/understanding-roles#basic) of **Editor** , **Owner** , and **Viewer**.\n\n| **Note:** To write or access Cloud Run functions logs, a project member must also have the appropriate logging permissions. For more information, see the [Cloud Logging access control guide](/logging/docs/access-control).\n\nAccess control for service accounts\n-----------------------------------\n\nA\n[service account](/iam/docs/service-account-types) is a special type of\nGoogle Cloud account that acts as an identity for a non-human user that needs to\nauthenticate and be authorized to access data and perform various actions. Some\nof these accounts are\n[created and managed by Google itself](/iam/docs/service-account-types#google-managed)\nand are known as\n[*service agents*](/iam/docs/service-agents).\n\nThe following service accounts are used for Cloud Run functions:\n\n| **Note:**\n| The [`iam.automaticIamGrantsForDefaultServiceAccounts` organization policy constraint](/resource-manager/docs/organization-policy/restricting-service-accounts#disable_service_account_default_grants)\n| prevents the Editor role from being automatically granted to default service accounts. If you\n| created your organization after May 3, 2024, this constraint is enforced by\n| default.\n|\n|\n| We strongly recommend that you enforce this constraint to disable the automatic role grant. If you\n| disable the automatic role grant, you must decide which roles to grant to the default service\n| accounts, and then [grant these roles](/iam/docs/granting-changing-revoking-access)\n| yourself.\n|\n|\n| If the default service account already has the Editor role, we recommend that you replace the\n| Editor role with less permissive roles.To safely modify the service account's roles, use [Policy Simulator](/policy-intelligence/docs/simulate-iam-policies) to see the impact of\n| the change, and then [grant and revoke the\n| appropriate roles](/iam/docs/granting-changing-revoking-access).\n\n### Runtime service accounts\n\nAt runtime, Cloud Run functions defaults\nto using the Compute Engine default service account\n(`PROJECT_NUMBER-compute@developer.gserviceaccount.com`), which also has\nthe **Editor** role on the project. You can change the roles of these service\naccounts to limit or extend the permissions for your running functions. You can\nalso change which service account is used by\n[avoiding the default service account when configuring service identity](/run/docs/securing/service-identity#default_service_account).\n\nTo learn more about service accounts, see the\n[service accounts documentation](/iam/docs/understanding-service-accounts).\n| **Note:** Authenticating as the runtime service account from inside your function might fail if you change the Cloud Run functions service account permissions.\n\n### Administrative service accounts\n\nTo perform administrative actions on your project during the creation,\nupdating, or deletion of functions, all projects in Cloud Run functions\nrequire the Google Cloud Functions Service Agent service account\n(`service-PROJECT_NUMBER@gcf-admin-robot.iam.gserviceaccount.com`).\n\nIn addition, all runtimes carry out container image building and storage within\nyour project. To support this, you also need to provision the following:\n\n- The [legacy Cloud Build service account](/build/docs/cloud-build-service-account)^1^ (`PROJECT_NUMBER@cloudbuild.gserviceaccount.com`)\n- The [Cloud Build Service Agent service account](/iam/docs/understanding-roles#service-management-roles) (`service-PROJECT_NUMBER@gcp-sa-cloudbuild.iam.gserviceaccount.com`)\n- The [Google Container Registry Service Agent service account](/container-registry/docs/overview#container_registry_service_account) (`service-PROJECT_NUMBER@containerregistry.iam.gserviceaccount.com`)\n\nThese service accounts should have the roles listed in the earlier\n[table](#roles).\n\n#### Google Cloud Functions Service Agent service account\n\nBy default, the Google Cloud Functions Service Agent service account\n(`service-PROJECT_NUMBER@gcf-admin-robot.iam.gserviceaccount.com` has\nthe **cloudfunctions.serviceAgent** role on your project.\n| **Warning:** If you remove the default role binding or modify the permissions granted to the Cloud Functions Service Agent service account on your Google Cloud project, create, update, and delete operations might fail.\n\nHere's a few of the notable permissions that the `cloudfunctions.serviceAgent`\nuses:\n\nYou can see the entire set of permissions under the [predefined IAM roles](/iam/docs/understanding-roles#cloudfunctions.serviceAgent)\nor by running this command: \n\n```bash\ngcloud iam roles describe roles/cloudfunctions.serviceAgent\n```\n\n\u003cbr /\u003e\n\nReset this service account to the default role by removing whatever role it has\nand adding the Cloud Functions Service Agent role: \n\n```bash\ngcloud projects add-iam-policy-binding PROJECT_ID \\\n --member serviceAccount:service-PROJECT_NUMBER@gcf-admin-robot.iam.gserviceaccount.com \\\n --role roles/cloudfunctions.serviceAgent\n```\n\nTroubleshooting permission errors\n---------------------------------\n\nIf you get permission errors when you deploy, update, delete, or execute\nfunctions in your project, perform the following steps:\n\n1. Make sure that you have the **Editor** or **Owner** role on your project, or\n that you are using the **Cloud Functions Developer** role.\n\n If you are using the **Cloud Functions Developer** role at the project\n level, also ensure that you have\n [granted the user the **IAM Service Account User** role](/functions/docs/reference/iam/roles#additional-configuration).\n\n Currently, only execution permissions are allowed at the per-function level.\n2. Verify that the Cloud Functions Service Agent service account\n (`service-PROJECT_NUMBER@gcf-admin-robot.iam.gserviceaccount.com`) has the\n [Cloud Functions Service Agent](/iam/docs/understanding-roles#cloudfunctions.serviceAgent)\n (`cloudfunctions.serviceAgent`) role for your project.\n\n Make sure the **Include Google-provided role grants** box on the\n **Permissions** tab of the [Console IAM](https://console.cloud.google.com/iam-admin/iam/) page\n is checked to see this account. Or you can use\n `gcloud projects add-iam-policy-binding PROJECT_ID`.\n3. Ensure that you have permissions for trigger sources, such as\n [Pub/Sub](/run/docs/triggering/pubsub-triggers) or\n [Cloud Storage](/run/docs/triggering/storage-triggers).\n\nIf you get an \"insufficient permissions\" error, or have other\nauthentication problems when you run your functions, make sure that the runtime\nservice account has the correct permissions to access the resources your\nfunctions need. Then, repeat steps 2 and 3.\n\nIf you get a \"service unavailable\" error during deployment, make\nsure that the runtime service account `PROJECT_ID@appspot.gserviceaccount.com`\nexists in your project. To recreate this service account if it was deleted, see\n[Undeleting a service account](/iam/docs/service-accounts-delete-undelete#undeleting).\n\nSee also [Troubleshoot Cloud Run functions](/functions/docs/troubleshooting).\n\n^1^ Cloud Run functions only uses the\n[legacy Cloud Build service account](/functions/docs/release-notes#July_11_2024)\nfor projects created before July 2024."]]
