# Set the service account that will run the Cloud Run application
export SERVICE_ACCOUNT="cloud-run-app@$PROJECT_ID.iam.gserviceaccount.com""cloud-run-deployer@$PROJECT_ID.iam.gserviceaccount.com"
```

### **1.2 Create the Deployment Service Account**

[Section titled “1.2 Create the Deployment Service Account”](#12-create-the-deployment-service-account)

We will create a **separate deployment service account** (DEPLOY\_SERVICE\_ACCOUNT) for the following reasons:

1. **Security**: By using a dedicated service account for deployments, you can limit its permissions to only what’s necessary for deploying the application and avoid granting unnecessary access to other resources.
2. **Impersonation**: The deployment service account (used by GitHub Actions) needs to impersonate another service account that is used to **run** the Cloud Run application. This allows it to delegate specific tasks (like database access, secret access, etc.) to that service account.

Run the following command to create the **deployment service account** (DEPLOY\_SERVICE\_ACCOUNT):

```bash