Short answer: the identity that your worker uses to call the Cloud Run Jobs API must have permission to “act as” the service account you set in your job variables. Even if the worker and the job both use the same service account email, you still need to grant that principal

iam.serviceAccounts.actAs

on that service account. What to check and fix: - Identify the caller identity your Prefect worker is using on GCP (e.g., the service account on the Cloud Run service/VM/container running the worker). I’ll call this WORKER_SA. - The service account you’ve configured in your Cloud Run v2 job variables (the one the job will run as) I’ll call JOB_SA. - Grant WORKER_SA the Service Account User role on JOB_SA:

gcloud iam service-accounts add-iam-policy-binding JOB_SA@PROJECT_ID.iam.gserviceaccount.com \
    --member="serviceAccount:WORKER_SA@PROJECT_ID.iam.gserviceaccount.com" \
    --role="roles/iam.serviceAccountUser"

Note: If WORKER_SA == JOB_SA, you still need this binding (a service account does not implicitly have actAs on itself). - Ensure WORKER_SA also has sufficient Cloud Run permissions to run jobs. The simplest is: -

roles/run.admin

(broad), or at minimum a role that can run jobs (e.g., developer-level or job runner) on the project/region you’re targeting. - If your job’s image is in Artifact Registry, ensure the runtime SA (JOB_SA) can pull it: -

roles/artifactregistry.reader

on the repo/project. - If your job references Secret Manager secrets, grant JOB_SA

roles/secretmanager.secretAccessor

to those secrets. Prefect job variable for the service account: - In Prefect’s Cloud Run v2 work pool, the job variable to set the execution service account is the service account email. In most setups this is set via a key like

service_account

in the pool’s job variables (e.g.,

<mailto:sa-name@project-id.iam.gserviceaccount.com|sa-name@project-id.iam.gserviceaccount.com>

). If you can share: - Where your Prefect worker is running (Cloud Run service, GCE VM, local, etc.) - The worker’s service account (WORKER_SA) - The job vars you set for the pool (you can redact anything sensitive) …I can validate the exact binding you need and double-check the job variable key.