Default service account use in servicer side GTM cloud run deployment

[MrHoosk]

I noticed with both the manual set-up and the automatic set-up of cloud run for server-side GTM the default compute service account is used. Given the warnings Google themselves talk about when it comes to excess permissions, this seems an oversight. Has anyone gone so far as to create their own sGTM cloud-run service account? If so what permissions are required by the service to function?

[lawrencenelson]

Hi @MrHoosk,

Welcome to the Google Cloud Community!

It is great that you're following best practices regarding the least privileged permission. As mentioned in this documentation;

By default, Cloud Run services or jobs run as the default Compute Engine service account. However, Google recommends using a user-managed service account with the most minimal set of permissions. Learn how to deploy Cloud Run services or create Cloud Run jobs with user-managed service accounts in the Cloud Run service identity documentation. 

Google Cloud has a tool called Recommender, one of its functions is to optimize Service accounts for a Cloud Run service, so the service account has the minimal set of required permissions [1]. You may view this documentation for details regarding Recommender.

I hope this helps. Thank you. 😃

[1]. https://cloud.google.com/run/docs/recommender#optimize-security

[MrHoosk]

That is all very useful information, but it does not really help in understanding the permissions a cloud-run service deployed for server-side GTM needs? The recommender, when cloud logging is off in the service, recommends removing all permissions for a service account. My assumption would be this is because it has not used any of those permissions in its deployed state.  It is tricky to figure out and feel confident in deployed a bespoke account without knowing exactly the permissions required for all of the possible operations of cloud run for gtm