FACTUAL ACTIVITY RECORD · An activity record based on work that took place
Granting image-read access only to the Cloud Run deployer
Adding IAM for the fixed Artifact Registry and an explicit resource-creation order
Purpose
Initial Cloud Run service creation returned 403 because the Terraform apply identity could not resolve the container image. The necessary minimum read access had to go to the deployer without adding unnecessary permission to the runtime identity.
Implementation
In runtime IAM policy, the Terraform apply identity receives Reader only on the fixed Broker Artifact Registry repository. The permission is not expanded to every registry in the project.
service deployment definition explicitly creates Cloud Run after the repository IAM binding exists. The runtime service account receives no image-read permission, and the specification plus infrastructure verification were aligned with that boundary.
Rendering diagram…
What was confirmed
Verification results
Terraform formatting, backend-free initialization, validation, GCP verification, secret scanning, and specification auditing passed.
Static checks confirmed that access was limited to the fixed repository and apply identity, with no added permission on the runtime identity.
Cloud Run creation and the canary had not been verified by the cutoff.
Basis for completion
This scope ended when only the deployer could read the fixed repository and both creation ordering and least privilege were statically verifiable.