title: Why does enabling the Cloud Run API create so many service accounts? Why do they have so many privileges?
body: <p>Enabling the Cloud Run API (dev console→Cloud Run→Enable) creates five service accounts. I want to understand their purpose. I need to know if it's my responsibility to configure them for least privileged access.</p>
  
  <p>The <code>Default compute service account</code> has the <code>Editor</code> role. This is the <a href="https://cloud.google.com/run/docs/securing/service-identity?hl=en#runtime_service_account" rel="noreferrer">Cloud Run runtime service account</a>. Its purpose is clear, and I know it's my responsibility to configure it for least privileged access.</p>
  
  <p>The <code>App Engine default service account</code> has the <code>Editor</code> role. This matches the description of the <a href="https://cloud.google.com/functions/docs/securing/function-identity" rel="noreferrer">Cloud Functions runtime service account</a>. Its purpose is unclear, given the existence of the Cloud Run runtime service account. I don't know if it's my responsibility to configure it for least privileged access.</p>
  
  <p>The <code>Google Container Registry Service Agent</code> (<code>Editor</code> role) and <code>Google Cloud Run Service Agent</code> (<code>Cloud Run Service Agent</code> role) are both <a href="https://cloud.google.com/iam/docs/service-accounts#google-managed_service_accounts" rel="noreferrer">Google-managed service accounts</a> "used to access the APIs of Google Cloud Platform services":</p>
  
  <p>I'd like to see Google-managed service accounts configured for least privileged access. I'd also like to be able to filter the Google-managed service accounts in the IAM section of the GCP console. That said, I know I should ignore them.</p>
  
  <p>The unnamed <code>{project-number}{at}cloudbuild.gserviceaccount.com</code> service account has the <code>Cloud Build Service Account</code> role. This service account "can perform builds" but does not appear in the Cloud Run <a href="https://cloud.google.com/run/docs/building/containers" rel="noreferrer">Building Containers</a> docs. It's used for <a href="https://cloud.google.com/run/docs/continuous-deployment" rel="noreferrer">Continuous Deployment</a>—but can't do that without additional user configuration. It's not a Google-managed service account, but it does not appear in the Service Accounts section of the GCP console like the runtime service accounts. Its purpose is unclear. I don't know if it's my responsibility to configure it for least privileged access.</p>