Cloud Run Python service needs read/write access to a Cloud Storage bucket in the same project with least privilege. What should you do?

Creating a user-managed service account and granting it a custom IAM role with only the necessary read/write permissions for the specific Cloud Storage bucket adheres to the principle of least privilege. This ensures the service account has no more access than required, enhancing security. Granting the Storage Admin IAM role is too permissive as it allows full control over all Cloud Storage resources in the project, violating least privilege. The Project Editor IAM role is even broader, granting extensive permissions across many Google Cloud services, which is highly insecure for a Cloud Run service. Using the default service account for Cloud Run is generally discouraged for production environments because it often has broad default permissions (like Project Editor), making it a security risk. Best practice dictates using dedicated, least-privileged service accounts for production workloads.