Google Cloud setup

What gets deployed

All three workloads use Cloud Run. Agents also call Vertex AI at runtime.

Three Google accounts, not one key

The JSON you paste is only the deployer. Cloud Build and Cloud Run still run as other accounts in the same project. Missing grants on those accounts is the usual “key works, deploy fails” case.

1. Turn on these APIs

Console → APIs & Services → Enable APIs, on the same project as project_id in the JSON. These are not enabled when you save the key.

Copy-paste (replace YOUR_PROJECT_ID):

gcloud services enable \
  run.googleapis.com \
  cloudbuild.googleapis.com \
  artifactregistry.googleapis.com \
  storage.googleapis.com \
  logging.googleapis.com \
  iam.googleapis.com \
  iamcredentials.googleapis.com \
  cloudresourcemanager.googleapis.com \
  serviceusage.googleapis.com \
  compute.googleapis.com \
  aiplatform.googleapis.com \
  monitoring.googleapis.com \
  --project=YOUR_PROJECT_ID

2. Roles on the key you paste

Use Artifact Registry Admin, not Writer — Writer cannot create the repository on first deploy. Include both roles/run.invoker (call the service) and roles/aiplatform.user (Vertex / Gemini). Invoker on the project lets the key call every Cloud Run service; you still bind it on each service for allUsers or other callers (step 5).

gcloud iam service-accounts create deployer \
  --display-name="Deployer" \
  --project=YOUR_PROJECT_ID

SA=deployer@YOUR_PROJECT_ID.iam.gserviceaccount.com
PROJECT=YOUR_PROJECT_ID

for ROLE in \
  roles/run.admin \
  roles/run.invoker \
  roles/cloudbuild.builds.editor \
  roles/artifactregistry.admin \
  roles/storage.admin \
  roles/iam.serviceAccountUser \
  roles/logging.viewer \
  roles/monitoring.viewer \
  roles/aiplatform.user
do
  gcloud projects add-iam-policy-binding $PROJECT \
    --member="serviceAccount:$SA" \
    --role="$ROLE"
done

3. Cloud Build worker (not your JSON key)

Granting Artifact Registry only on the JSON key does not let Cloud Build push. Grant these on PROJECT_NUMBER@cloudbuild.gserviceaccount.com.

PROJECT_NUMBER=$(gcloud projects describe YOUR_PROJECT_ID --format="value(projectNumber)")
CB=$PROJECT_NUMBER@cloudbuild.gserviceaccount.com

gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:$CB" --role="roles/artifactregistry.writer"

gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:$CB" --role="roles/storage.admin"

gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:$CB" --role="roles/logging.logWriter"

4. Cloud Run runtime account (agents)

Unless you set a custom runtime account, Cloud Run uses the Compute default. The deployer needs Service Account User on it. Agents call Vertex from inside the container, so the runtime account must have roles/aiplatform.user — granting it only on the JSON key is not enough.

PROJECT_NUMBER=$(gcloud projects describe YOUR_PROJECT_ID --format="value(projectNumber)")
COMPUTE=$PROJECT_NUMBER-compute@developer.gserviceaccount.com

gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:$COMPUTE" --role="roles/aiplatform.user"

gcloud iam service-accounts add-iam-policy-binding $COMPUTE \
  --member="serviceAccount:deployer@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountUser" \
  --project=YOUR_PROJECT_ID

5. Who can call Cloud Run (roles/run.invoker)

Cloud Run is private by default. roles/run.admin creates the service; roles/run.invoker is who may send HTTP requests. Bind invoker on the service (or at project level on the JSON key, as in step 2).

Public (anyone on the internet):

gcloud run services add-iam-policy-binding SERVICE_NAME \
  --region=YOUR_REGION \
  --member="allUsers" \
  --role="roles/run.invoker" \
  --project=YOUR_PROJECT_ID

Private (only the deployer service account):

gcloud run services add-iam-policy-binding SERVICE_NAME \
  --region=YOUR_REGION \
  --member="serviceAccount:deployer@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/run.invoker" \
  --project=YOUR_PROJECT_ID

6. Download the JSON and paste it

Organization settings → Cloud accounts → Add credential → GCP service account. Paste the whole file. The key type must be service_account.

gcloud iam service-accounts keys create gcp-key.json \
  --iam-account=deployer@YOUR_PROJECT_ID.iam.gserviceaccount.com

If something still fails