Question: I have a small python app running in google cloud run with docker. The application is triggered by http requests, executes a query in big query and return the result. Unfortunately I get the following permission error:

```
Reason: 403 POST https://bigquery.googleapis.com/bigquery/v2/projects/XXXX/jobs: Access Denied: Project XXXX: User does not have bigquery.jobs.create permission in project XXXX.\n\n(job ID: XXXX-XX-XX-XX-XXXX)\n\n

```

I understand I need to give access from cloud run to big query. How do I do it? to which user? how can i find out?

Answer: 
You need to add BiqQuery permissions via IAM Roles to the service account assigned to Cloud Run.

To allow Cloud Run to create Big Query jobs (bigquery.jobs.create) you need one of the following roles:

* roles/bigquery.user
* roles/bigquery.jobUser

The service account for Cloud Run is displayed in the Google Cloud Console in the Cloud Run section for your service. Most likely this is `Compute Engine default service account`.

To add a BiqQuery role, you can use the Google Cloud Console. Go to IAM, find the service account. Add roles to the service account.

Documentation:

* [BigQuery predefined Cloud IAM roles](https://cloud.google.com/bigquery/docs/access-control#bigquery)
* [Service accounts on Cloud Run (fully managed)](https://cloud.google.com/run/docs/configuring/service-accounts)
* [Granting roles to service accounts](https://cloud.google.com/iam/docs/granting-roles-to-service-accounts)
One of the issues could be that Service Account which your Cloud Run job is using does not have permissions on BigQuery.

You can update the service account permission and add `roles/bigquery.user` role to create a job.
Also, based on your application requirement add relevant roles. You can see details about different BigQuery roles [here.](https://cloud.google.com/bigquery/docs/access-control)

A good rule is provide only required permissions to a service account.

I hope this helps.