I have a Ruby on Rails application deployed on Google Cloud Run that uses Google Storage. I added a role with necessary permissions to the associated compute engine service account, and when I set IAM to true in the storage.yml, active storage works fine:

google:
  service: GCS
  iam: true
  bucket: <%= Rails.application.credentials.dig(:gcs, :storage, :bucket_name) %>

However, I need to instantiate Google::Cloud::Storage in order to generate the signed url. I want to do it without explicitly passing credentials to the initializer. I found in the documentation that:

application[s] [that] run on an Google Cloud Platform hosting environment such
as Google Compute Engine, Google Container Engine, Google App Engine,
Google Cloud Run, or Google Cloud Functions, the environment will
provide “ambient” credentials which client libraries will recognize
and use automatically. You can generally configure these credentials
in the hosting environment, for example per-VM in Google Compute
Engine.

Does that mean that I still need to add the credentials to ENV variables in the Cloud Run container, or is there a way to do it implicitly, ie via IAM.