I have a GCP Cloud Run service that needs to be read from a bucket. The service runs with its dedicated service account.

I see that the service can read the bucket without any explicitly given permissions/roles to do so, such as storage.objects.list/roles/storage.objectViewer.

Strangely, if I run the service locally on my machine locally (with a service account key I specifically generated from that service account for this experiment), the service cannot read the bucket as it should be. If, during the local run, I do add the roles/storage.objectViewer to that service account, the service can read the bucket (which is obviously expected).

I am confused because when the service runs in Cloud Run, it magically acquires the permissions to read that bucket, and I cannot figure out how.

Any advice?