gcloud "PERMISSION_DENIED" - Fix IAM Permissions in CI

By Kaveh Alemi·Latchkey

gcloud authenticated, but the service account lacks the IAM role needed for this operation - or the required API is not enabled on the project. This is authorization, not authentication.

What this error means

A gcloud operation fails with PERMISSION_DENIED and "The caller does not have permission". The account is valid (auth succeeded); it simply lacks the role/permission, so it fails deterministically until IAM is fixed.

gcloud output

ERROR: (gcloud.run.deploy) PERMISSION_DENIED: Permission 'run.services.create'
denied on resource 'namespaces/my-proj/services' (or it may not exist).

Common causes

Service account missing the IAM role

The account lacks the role that grants the needed permission (e.g. roles/run.admin for run.services.create). The error names the exact permission denied.

Required API not enabled

If the target API (Cloud Run, Cloud Build) is not enabled on the project, calls are denied as if the permission is missing.

How to fix it

Grant the needed role

Bind the least-privilege role that includes the denied permission to the deploy service account.

Terminal

gcloud projects add-iam-policy-binding my-proj \
  --member="serviceAccount:deployer@my-proj.iam.gserviceaccount.com" \
  --role="roles/run.admin"

Enable the required API

Make sure the service’s API is enabled on the project.

Terminal

gcloud services enable run.googleapis.com cloudbuild.googleapis.com --project my-proj

How to prevent it

Bind least-privilege roles to the deploy service account up front.
Enable required APIs as part of project setup, not per deploy.
Use gcloud ... --impersonate-service-account to test the deploy identity’s permissions.

Frequently asked questions

What causes ""PERMISSION_DENIED""?

The account lacks the role that grants the needed permission (e.g. roles/run.admin for run.services.create). The error names the exact permission denied.

How do I fix "PERMISSION_DENIED"?