adk deploy cloud_run fails with PERMISSION_DENIED, requires manual IAM binding for Cloud Build service account

[LLM-Implementation]

Describe the bug
When attempting to deploy an agent using adk deploy cloud_run, the process fails with a PERMISSION_DENIED error. This occurs because the default Cloud Build service account ([PROJECT_NUMBER]@cloudbuild.gserviceaccount.com) lacks the necessary roles/iam.serviceAccountUser IAM permission to act on behalf of other services or manage resources during the deployment to Cloud Run.

To Reproduce
Steps to reproduce the behavior:

1. Set up the required environment variables for a Google Cloud Project:

   export GOOGLE_CLOUD_PROJECT="your-gcp-project-id"
   export GOOGLE_CLOUD_LOCATION="your-gcp-region"
   export AGENT_PATH="./path-to-your-agent-code" # e.g., ./google-search-agent
   export SERVICE_NAME="your-cloud-run-service-name" # e.g., google-search-agent
   export APP_NAME="your-app-name" # e.g., google-search-agent-app

2. Ensure the Cloud Build API is enabled in the Google Cloud Project.
3. Attempt to deploy the agent using the ADK command:

   adk deploy cloud_run \
     --project=$GOOGLE_CLOUD_PROJECT \
     --region=$GOOGLE_CLOUD_LOCATION \
     --service_name=$SERVICE_NAME \
     --app_name=$APP_NAME \
     --with_ui \
     $AGENT_PATH

4. See error: ERROR: (gcloud.run.deploy) PERMISSION_DENIED: Build failed because the service account [PROJECT_NUMBER]@cloudbuild.gserviceaccount.com is missing required IAM permissions. Please grant [roles/iam.serviceAccountUser] to the service account. (or similar).

Expected behavior
The adk deploy cloud_run command should ideally:

• Successfully complete the deployment without manual IAM intervention if possible.

Screenshots:

Additional context
The issue can be manually resolved by granting the roles/iam.serviceAccountUser to the Cloud Build service account:

gcloud projects add-iam-policy-binding $GOOGLE_CLOUD_PROJECT \
  --member="serviceAccount:${PROJECT_NUMBER}@cloudbuild.gserviceaccount.com" \
  --role="roles/iam.serviceAccountUser"

[kanlanc]

This seems more like a classic GCP issue then ADK issue, have you tried updating the permissions in your GCP account?

[LLM-Implementation]

I tried gcloud projects add-iam-policy-binding $GOOGLE_CLOUD_PROJECT \ --member="serviceAccount:${PROJECT_NUMBER}@cloudbuild.gserviceaccount.com" \ --role="roles/iam.serviceAccountUser" to grant the permission after getting the error by running the deploy command lines. Seems that it automatically created a service account while deploying but it hasn't granted permission to the account.

[kanlanc]

Interesting, try going into the console, into the iam tab and manually adding this permission to it.

I remember coming across the same issue and doing this fixed it

[seanzhou1023]

@Jacksunwei & @polong-lin could you take a look whether we need to improve our documents for deploy ?

[dhrubajyoti2006]

For me, the API runs properly, but when I try to deploy, I am getting the following error -

"Deploy failed: [WinError 2] The system cannot find the file specified". I dont see any log in Log Explorer in cloud