google / google/mcp-security

Docs: Clarification in README.md for the Cloud Run set up

Open
#132 1 comment 0 reactions 0 assignees View on GitHub
documentation
Dominant language
Python
Stars
528
Forks
141
Avg merge
3d 2h
Merged PRs (30d)
6

Description

Update/add to: https://github.com/google/mcp-security/blob/main/run-with-google-adk/README.md#prerequisites-1

2. Must have the [proper permissions for the identity deploying the server](https://cloud.google.com/run/docs/deploying-source-code#required_roles) and [proper permissions for the default compute engine service account](https://cloud.google.com/run/docs/deploying-source-code#required-roles-for-the-cloud-build-service-account).

If these permissions are not present you will get this error regarding the default Service Account:
```
Deployment failed

ERROR: (gcloud.run.deploy) INVALID_ARGUMENT: Invalid build request. could not resolve source: googleapi: Error 403: xxxxxxxxx-compute@developer.gserviceaccount.com does not have storage.objects.get access to the Google Cloud Storage object. Permission 'storage.objects.get' denied on resource (or it may not exist)., forbidden
Failed to deploy the service.
```

**Explanation:**
Note:
The [iam.automaticIamGrantsForDefaultServiceAccounts organization policy constraint](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts#disable_service_account_default_grants) prevents the Editor role from being automatically granted to default service accounts. If you created your organization after May 3, 2024, this constraint is enforced by default.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.