Cloud Scheduler Permission Denied (Code 7)

Problem

Cloud Scheduler jobs silently fail to trigger Cloud Run jobs. The scheduler shows as ENABLED, attempts are made (lastAttemptTime updates), but Cloud Run jobs never start. The only indicator is status.code: 7 which means PERMISSION_DENIED.

Context / Trigger Conditions

• Cloud Run jobs previously ran on schedule but stopped
• Dashboard shows jobs as "FAILED" or "DONE" with old timestamps
• gcloud scheduler jobs describe <name> shows:

  lastAttemptTime: '2026-02-08T14:00:03.316530Z'
  state: ENABLED
  status:
    code: 7
  

• No obvious errors in Cloud Logging for the scheduler

Solution

1. Identify the scheduler's service account:

   gcloud scheduler jobs describe <scheduler-name> \
     --location=<region> \
     --project=<project> \
     --format="yaml(httpTarget.oauthToken.serviceAccountEmail)"
   

2. Grant run.invoker role to that service account:

   gcloud projects add-iam-policy-binding <project-id> \
     --member="serviceAccount:<service-account-email>" \
     --role="roles/run.invoker"
   

3. Test by manually triggering the scheduler:

   gcloud scheduler jobs run <scheduler-name> \
     --location=<region> \
     --project=<project>
   

4. Verify the Cloud Run job started:

   gcloud run jobs executions list \
     --region=<region> \
     --project=<project> \
     --limit=5
   

Verification

After granting permissions and triggering:

• status.code should no longer be 7 on next attempt
• New Cloud Run job execution should appear in executions list
• Execution should show RUNNING status

Example

# Check scheduler status - note code: 7
gcloud scheduler jobs describe profile-crawler-schedule \
  --location=us-central1 \
  --project=my-project

# Grant permission
gcloud projects add-iam-policy-binding my-project \
  --member="serviceAccount:my-scheduler@my-project.iam.gserviceaccount.com" \
  --role="roles/run.invoker"

# Test
gcloud scheduler jobs run profile-crawler-schedule \
  --location=us-central1 \
  --project=my-project

Notes

• Status code 7 is gRPC's PERMISSION_DENIED - not documented prominently for Cloud Scheduler
• This commonly happens after:
  • Creating new service accounts
  • Migrating projects
  • IAM policy updates that remove inherited permissions
  • Using a custom service account instead of the default
• The scheduler will keep attempting (and failing) silently - no alerts by default
• Consider adding Cloud Monitoring alerts for scheduler failures

References

• Cloud Scheduler HTTP targets
• Cloud Run IAM roles
• gRPC status codes