title: GCP Cloud Run Cannot Pull Image from Artifact Registry in Other Project
body: <p>I have a <strong>parent</strong> project that has an artifact registry configured for docker.</p>
  <p>A <strong>child</strong> project has a cloud run service that needs to pull its image from the <strong>parent</strong>.</p>
  <p>The <strong>child</strong> project also has a service account that is authorized to access the repository via an IAM role <strong>roles/artifactregistry.writer</strong>.</p>
  <p>When I try to start my service I get an error message:</p>
  <blockquote>
  <p>Google Cloud Run Service Agent must have permission to read the image,
  europe-west1-docker.pkg.dev/test-parent-project/docker-webank-private/node:custom-1.
  Ensure that the provided container image URL is correct and that the
  above account has permission to access the image. If you just enabled
  the Cloud Run API, the permissions might take a few minutes to
  propagate. Note that the image is from project [test-parent-project], which
  is not the same as this project [test-child-project]. Permission must be
  granted to the Google Cloud Run Service Agent from this project.</p>
  </blockquote>
  <p>I have tested manually connecting with <em>docker login</em> and using the service account's private key and the <em>docker pull</em> command works perfectly from my PC.</p>
  <pre><code>cat $GOOGLE_APPLICATION_CREDENTIALS | docker login -u _json_key --password-stdin https://europe-west1-docker.pkg.dev
  &gt; Login succeeded
  docker pull europe-west1-docker.pkg.dev/bfb-cicd-inno0/docker-webank-private/node:custom-1
  &gt; OK
  </code></pre>
  <p>The service account is also attached to the cloud run service:</p>
  <p><a href="https://i.stack.imgur.com/e2XJX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/e2XJX.png" alt="enter image description here" /></a></p>