Docs: Clarification in README.md for the Cloud Run set up
- Dominant language
- Python
- Stars
- 528
- Forks
- 141
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 6
Description
Update/add to: https://github.com/google/mcp-security/blob/main/run-with-google-adk/README.md#prerequisites-1
2. Must have the [proper permissions for the identity deploying the server](https://cloud.google.com/run/docs/deploying-source-code#required_roles) and [proper permissions for the default compute engine service account](https://cloud.google.com/run/docs/deploying-source-code#required-roles-for-the-cloud-build-service-account).
If these permissions are not present you will get this error regarding the default Service Account:
```
Deployment failed
ERROR: (gcloud.run.deploy) INVALID_ARGUMENT: Invalid build request. could not resolve source: googleapi: Error 403: xxxxxxxxx-compute@developer.gserviceaccount.com does not have storage.objects.get access to the Google Cloud Storage object. Permission 'storage.objects.get' denied on resource (or it may not exist)., forbidden
Failed to deploy the service.
```
**Explanation:**
Note:
The [iam.automaticIamGrantsForDefaultServiceAccounts organization policy constraint](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts#disable_service_account_default_grants) prevents the Editor role from being automatically granted to default service accounts. If you created your organization after May 3, 2024, this constraint is enforced by default.
Contributor guide
Assessment
This issue has not been assessed yet.