cloud-scheduler-permission-denied

name	cloud-scheduler-permission-denied
description	Fix Google Cloud Scheduler silently failing to trigger Cloud Run jobs with status code 7 (PERMISSION_DENIED). Use when: (1) Cloud Run jobs stop running but schedulers show ENABLED, (2) gcloud scheduler jobs describe shows lastAttemptTime but status.code: 7, (3) Jobs worked before but stopped after IAM changes or project updates. The scheduler service account needs roles/run.invoker on the project.
author	Claude Code
version	1.0.0
date	"2026-02-08T00:00:00.000Z"

Cloud Scheduler Permission Denied (Code 7)

Problem

Cloud Scheduler jobs silently fail to trigger Cloud Run jobs. The scheduler shows as ENABLED, attempts are made (lastAttemptTime updates), but Cloud Run jobs never start. The only indicator is status.code: 7 which means PERMISSION_DENIED.

Context / Trigger Conditions

• Cloud Run jobs previously ran on schedule but stopped
• Dashboard shows jobs as "FAILED" or "DONE" with old timestamps
• gcloud scheduler jobs describe <name> shows:

  lastAttemptTime: '2026-02-08T14:00:03.316530Z'
  state: ENABLED
  status:
    code: 7
  

• No obvious errors in Cloud Logging for the scheduler

Solution

1. Identify the scheduler's service account:

   gcloud scheduler jobs describe <scheduler-name> \
     --location=<region> \
     --project=<project> \
     --format="yaml(httpTarget.oauthToken.serviceAccountEmail)"
   

2. Grant run.invoker role to that service account:

   gcloud projects add-iam-policy-binding <project-id> \
     --member="serviceAccount:<service-account-email>" \
     --role="roles/run.invoker"
   

3. Test by manually triggering the scheduler:

   gcloud scheduler jobs run <scheduler-name> \
     --location=<region> \
     --project=<project>
   

4. Verify the Cloud Run job started:

   gcloud run jobs executions list \
     --region=<region> \
     --project=<project> \
     --limit=5
   

Verification

After granting permissions and triggering:

• status.code should no longer be 7 on next attempt
• New Cloud Run job execution should appear in executions list
• Execution should show RUNNING status

Example

# Check scheduler status - note code: 7
gcloud scheduler jobs describe profile-crawler-schedule \
  --location=us-central1 \
  --project=my-project

# Grant permission
gcloud projects add-iam-policy-binding my-project \
  --member="serviceAccount:[e-mail]" \
  --role="roles/run.invoker"

# Test
gcloud scheduler jobs run profile-crawler-schedule \
  --location=us-central1 \
  --project=my-project

Notes

• Status code 7 is gRPC's PERMISSION_DENIED - not documented prominently for Cloud Scheduler
• This commonly happens after:
  • Creating new service accounts
  • Migrating projects
  • IAM policy updates that remove inherited permissions
  • Using a custom service account instead of the default
• The scheduler will keep attempting (and failing) silently - no alerts by default
• Consider adding Cloud Monitoring alerts for scheduler failures

References

• Cloud Scheduler HTTP targets
• Cloud Run IAM roles
• gRPC status codes