What is the GCP Service Account role to create Cloud Scheduler jobs? - google-cloud-platform

Question

I have a service account that has the usual roles to deploy images to Cloud Run instances and all is working fine. This is done through a GitHub Actions workflows that setups gcloud using the provided setup-gcloud action.
I wrote a bash script that runs some gcloud commands to create some Scheduler's jobs required for my project.
#!/bin/bash
run_command() {
gcloud scheduler jobs describe $1 --location=europe-west1 && echo "Job $1 already exists, skipping..." ||
echo "Creating scheduler job $1 with schedule $2 and uri $3$4..." &&
gcloud scheduler jobs create http $1 --location=europe-west1 \
--schedule "$2" \
--uri "$3$4" \
--http-method $5 \
--time-zone "Europe/Rome"
}
When running this in my workflow, the Action returns this error:
ERROR: (gcloud.scheduler.jobs.describe) PERMISSION_DENIED: The principal (user or service account) lacks IAM permission "cloudscheduler.jobs.get" for the resource "projects/***/locations/europe-west1/jobs/***" (or the resource may not exist).
Creating scheduler job *** with schedule 30 * * * * and uri ***...
ERROR: (gcloud.scheduler.jobs.create.http) PERMISSION_DENIED: The principal (user or service account) lacks IAM permission "cloudscheduler.jobs.create" for the resource "projects/***/locations/europe-west1" (or the resource may not exist).
The service account used to auth the gcloud instance inside the Action has the Cloud Scheduler Service Agent role assigned, which does not have the required permissions to do what I need.
The problem is that when trying to grant the Cloud Scheduler Admin role to this service account, it does not appear to be available in the list.
Do I have to create a custom role or am I doing something wrong with my service account usage?
Screenshot to show that the role doesn't appear in the list:

Answer 1

It's quite odd that the role is not appearing the list, but you can make use of gcloud to attach the admin role to the service account:
gcloud iam service-accounts add-iam-policy-binding \
test-proj1#example.domain.com \
--member='serviceAccount:test-proj1#example.domain.com' \
--role='roles/cloudscheduler.admin'
EDIT:
It is possible that the Role may be somehow disabled, in order to enable it you can follow the next steps:
Open the Google Cloud Console and navigate to the IAM & Admin page for your project.
In the IAM & Admin page, click on the "Roles" tab.
Search for the "Cloud Scheduler Admin" role using the search bar or by scrolling through the list of roles.
Once you have found the "Cloud Scheduler Admin" role, click on the "Restore" button next to it.
A confirmation window will appear. Click on the "Restore" button to confirm that you want to restore the role.
Once you have confirmed, the role will be restored and you will be able to assign it to users or service accounts as needed.

Answer 2

As per this document Cloud Scheduler Service Agent role is enough for a service account to schedule a job by using the cloud scheduler. In addition to this if you are using the cloud run to perform the job as per your requirement you need to provide Cloud Run Service Agent Role as well. In case if you are using cloud functions then you need to provide a Cloud functions service agent role.
In your invoke method try passing the service account email id by giving the --oidc-service-account-email flag
$ gcloud scheduler jobs create http HELLO \
--schedule="30 * * * *" --uri=$URI \
--oidc-service-account-email=CLIENT_SERVICE_ACCOUNT_EMAIL
Refer this document to know more about cloud scheduler with http authentication.
In case a normal scheduler wont work then try using the alpha and beta scheduler commands as well
alpha
scheduler
beta
scheduler
For more detailed information about cloud schedulers refer these documents DOC1
DOC2