title: Cloud Run - Allowing users to deploy a single resource, based on permissions
body: <p>I'm almost having an headache while trying to allow access on GCP Cloud Run for different users, for a specific service using permission attributes.</p>
  <p>Let's consider I have different services running, and I want to assign my developers to use <code>gcloud run deploy</code> only on a bunch of them. In my case, this is like as following:</p>
  <ul>
  <li>backend-service &gt; revisions can be deployed by backend-user only;</li>
  <li>frontend-service &gt; revisions can be deployed by frontend-user only;</li>
  </ul>
  <p>Both users have &quot;Cloud Run Developer&quot; role, and both services account have the &quot;ServiceAccountUser&quot; role as described <a href="https://cloud.google.com/run/docs/reference/iam/roles#additional-configuration" rel="nofollow noreferrer">here in GCP docs</a></p>
  <p>The issue I'm facing however is when I try to restrict user permissions for a single resource.
  Using the GCP web console, I've created a condition based on <code>Resource &gt; Name</code> to be <code>backend-service</code>.</p>
  <p>I instantly get this error when using <code>gcloud run deploy</code>:</p>
  <pre><code>ERROR: (gcloud.run.deploy) PERMISSION_DENIED: Permission 'run.services.update' denied on resource 'namespaces/PROJECT_ID/services/SERVICE_NAME' (or resource may not exist).
  make: *** [deploy] Error 1
  </code></pre>
  <p>As I could not find anything related to IAM permission conditions related to Cloud Run <a href="https://cloud.google.com/iam/docs/conditions-overview" rel="nofollow noreferrer">(they're not even listed afaik)</a> I tried changing the <code>Resource &gt; Name</code> condition value to <code>namespaces/PROJECT_ID/services/SERVICE_NAME</code>, but that didn't work too.</p>
  <p>As a side note, when checking permissions inside Cloud Run Web Console it shows
  <strong>Condition on Cloud Run Developer</strong></p>
  <pre><code>{
      &quot;expression&quot;: &quot;resource.name == \&quot;backend-service\&quot;&quot;,
      &quot;title&quot;: &quot;BackendService&quot;
  }
  </code></pre>