Google Cloud Run 2026-08-30

Use these rules for Google Cloud Run services, jobs, worker pools, revisions, identities, networking, secrets, containers, supply chain, observability, and deployment as documented on 2026-08-30. Treat source, build, artifact registry, deployer identity, service identity, ingress, egress, runtime instances, and managed control plane as separate trust boundaries.

Services and revisions

• Separate services where public exposure, identity, data classification, scaling, ownership, or deployment cadence differs.
• Deploy immutable reviewed images and route traffic only to revisions approved for that environment.
• Use revision tags for controlled testing and ensure tagged URLs do not bypass intended authentication or exposure policy.
• Remove stale revisions and tags after rollback windows so vulnerable code and configuration are not unexpectedly reachable.
• Keep production and preview projects, service accounts, secrets, domains, and data stores isolated.
• Review revision configuration changes for identity, environment, network, scale, and secret exposure; review service-level settings even when they do not create a revision.

Invocation and IAM

• Require authenticated invocation unless the service has an explicit reviewed public HTTP contract; for IAM-protected services, keep the Invoker IAM check enabled and remove allUsers Invoker grants.
• Grant roles/run.invoker only to exact service accounts, groups, or controlled principals and avoid broad project-level bindings.
• Use Google-signed ID tokens with the receiving service URL or a configured custom audience