title: IAM Permission Issue When Building a Cloud Run Container
body: <p>I am currently trying to copy a development project into a production one. All of the code and files are transferred already, but the Cloud Run functions are not building.</p>
  <p>I will provide some more information about the two project architectures, in case it might help. In the development project, we have a staging branch. Any changes pushed to this branch fires up Cloud Build triggers that do a sanity check on incoming changes and deploy the updated code. We can then merge these changes with the master branch and push, which fires additional Cloud Build triggers to copy over the code from the development project to the production one.</p>
  <p>The error is:</p>
  <p><code>ERROR: (gcloud.run.deploy) User [project-number@cloudbuild.gserviceaccount.com] does not have permission to access namespaces instance [Project ID] (or it may not exist): Permission 'iam.serviceaccounts.actAs' denied on service account cloud-run-pubsub-invoker@project-id.iam.gserviceaccount.com (or it may not exist).</code></p>
  <p>The <code>project-number@cloudbuild.gserviceaccount.com</code> has the following permissions: App Engine Admin, BigQuery Job User, Cloud Build Service Account, Cloud Functions Admin, Cloud Functions Developer, Cloud Scheduler Admin, Editor Service Account, Token Creator Service Account User, Pub/Sub Editor, Cloud Run Admin, Secret Manager Secret Accessor, Storage Object Admin</p>
  <p>I found a <a href="https://stackoverflow.com/questions/56068870/permission-error-when-trying-to-deploy-to-google-cloud-run">link</a> to another question with the same issue. The accepted solution was to add the following service account and role</p>
  <pre><code>Email: service-&lt;account-id&gt;@serverless-robot-prod.iam.gserviceaccount.com
  Role: Google Cloud Run Service Agent
  </code></pre>
  <p>to the IAM accounts. I tried this, and got this message: <code>No change: member already exists on the policy.</code>The error likely lies somewhere else.</p>
  <p>I also noticed that the account email <code>cloud-run-pubsub-invoker@project-id.iam.gserviceaccount.com</code> was present in the development project, but not the production one. I think this might be the source of the issue, but when I try adding this account through the IAM page (changing the project-id to that of the new project), an error states: <code>Email addresses and domains must be associated with an active Google Account, Google Workspace account, or Cloud Identity account.</code></p>
  <p>I am not sure how to fix this issue, and any help is appreciated. Thank you!</p>