cloud-scheduler-permission-denied

Cloud Scheduler Permission Denied (Code 7)

Problem

Cloud Scheduler jobs silently fail to trigger Cloud Run jobs. The scheduler shows as ENABLED, attempts are made (lastAttemptTime updates), but Cloud Run jobs never start. The only indicator is status.code: 7 which means PERMISSION_DENIED.

Context / Trigger Conditions

• Cloud Run jobs previously ran on schedule but stopped
• Dashboard shows jobs as "FAILED" or "DONE" with old timestamps
• gcloud scheduler jobs describe <name> shows:

  lastAttemptTime: '2026-02-08T14:00:03.316530Z'
  state: ENABLED
  status:
    code: 7
  

• No obvious errors in Cloud Logging for the scheduler

Solution

1. Identify the scheduler's service account:

   gcloud scheduler jobs describe <scheduler-name> \
     --location=<region> \
     --project=<project> \
     --format="yaml(httpTarget.oauthToken.serviceAccountEmail)"
   

2. Grant run.invoker role to that service account:

   gcloud projects add-iam-policy-binding <project-id> \
     --member="serviceAccount:<service-account-email>" \
     --role="roles/run.invoker"
   

3. Test by manually triggering the scheduler:

   gcloud scheduler jobs run <scheduler-name> \
     --location=<region> \
     --project=<project>
   

4. Verify the Cloud Run job started:

   gcloud run jobs executions list \
     --region=<region> \
     --project=<project> \
     --limit=5
   

Verification

After granting permissions and triggering:

• status.code should no longer be 7 on next attempt
• New Cloud Run job execution should appear in executions list
• Execution should show RUNNING status

Example

# Check scheduler status - note code: 7
gcloud scheduler jobs describe profile-crawler-schedule \
  --location=us-central1 \
  --project=my-project

# Grant permission
gcloud projects add-iam-policy-binding my-project \
  --member="serviceAccount:[email protected]" \
  --role="roles/run.invoker"

# Test
gcloud scheduler jobs run profile-crawler-schedule \
  --location=us-central1 \
  --project=my-project