# Only for deploying cloud run
gcloud iam service-accounts add-iam-policy-binding $SERVICE_ACCOUNT \
    --member="serviceAccount:$DEPLOY_SERVICE_ACCOUNT" \
    --role="roles/iam.serviceAccountUser" \
    --project="$PROJECT_ID"
```

In the above command, replace `$SERVICE_ACCOUNT` with the service account that will **run** the Cloud Run application (more details on this later).

### **1.4 Create and Download the Deployment Service Account Key**

[Section titled “1.4 Create and Download the Deployment Service Account Key”](#14-create-and-download-the-deployment-service-account-key)

Now generate the deployment service account key, which you will upload to GitHub as a secret.

```bash