[2025/1/15 までに対応必須] Cloud Run へのコンテナイメージを利用したデプロイについては権限追加が必要になります

Starting January 15, 2025, Cloud Run will begin explicitly verifying that users or service accounts creating or updating Cloud Run resources have the permission to access deployed container image(s).

We have provided additional information below to guide you through this change.

What you need to know
Currently, the Cloud Run Admin and Cloud Run Developer IAM roles implicitly give permission to deploy container images from Artifact Registry repositories in the same project.

However, starting January 15, 2025, users or service accounts creating or updating a Cloud Run resource will need explicit permission to access deployed container images.

What you need to do
Before January 15, 2025, after creating or updating your Cloud Run resources, use this link to look for "User does not have access to image" errors in audit logs.

If you see an error in audit logs after deploying, action is required:
Ensure that the principal (user or service account) creating or updating Cloud Run resources has the Artifact Registry Reader (roles/artifactregistry.reader) IAM role on the project or container repository containing the container image to be deployed. Refer to our Artifact Registry documentation for detailed instructions.

No action is required in the following cases:

- The person deploying to Cloud Run is a Project Owner or Editor.
- The person deploying to Cloud Run can already pull images from Artifact Registry in this project.
- You are deploying functions or sources to Cloud Run.
- You are using Cloud Functions for Firebase or Firebase App Hosting.
- You are deploying continuously using a Cloud Build Trigger in the same project.
- The Cloud Run audit logs do not contain any error after deploying.

export PROJECT_ID=$(gcloud config get-value project)

gcloud run deploy my-cloud-run-app \
  --image asia-northeast1-docker.pkg.dev/${PROJECT_ID}/docker-repo/my-cloud-run-app:latest \
  --region asia-northeast1

Allow unauthenticated invocations to [my-cloud-run-app] (y/N)?  y

Deploying container to Cloud Run service [my-cloud-run-app] in project [da-test-437400] region [asia-northeast1]
OK Deploying new service... Done.                                                                                                                                                         
  OK Creating Revision...                                                                                                                                                                 
  OK Routing traffic...                                                                                                                                                                   
  OK Setting IAM Policy...                                                                                                                                                                
Done.                                                                                                                                                                                     
Service [my-cloud-run-app] revision [my-cloud-run-app-00001-wtl] has been deployed and is serving 100 percent of traffic.
Service URL: https://my-cloud-run-app-891566352225.asia-northeast1.run.app

resource.type = "cloud_run_revision"
severity=ERROR
"User does not have access to image"

status: {
code: 403
message: "Cloud Run API check failed. Requests will be rejected after January 2025 hard enforcement deadline. User does not have access to image asia-northeast1-docker.pkg.dev/<PROJECT_ID>/docker-repo/my-cloud-run-app:latest"
}

gcloud run deploy my-cloud-run-app-2 \
  --image asia-northeast1-docker.pkg.dev/${PROJECT_ID}/docker-repo/my-cloud-run-app:latest \
  --region asia-northeast1