# Function Identity

This page provides supplemental information for configuring function identity for
functions created using the
[`gcloud functions`](https://docs.cloud.google.com/sdk/gcloud/reference/functions) commands or the
[Cloud Functions v2 API](https://docs.cloud.google.com/functions/docs/reference/rest.md.txt).

If you've created or deployed functions using Cloud Run, see
[Introduction to service identity](https://docs.cloud.google.com/run/docs/securing/service-identity.md.txt) and
[Configure service identity for services](https://docs.cloud.google.com/run/docs/configuring/services/service-identity.md.txt)
for a detailed description of configuring service identity. Cloud Run
refers to the function identity as the *service identity*.

For an introduction to the function identity concept, see the Cloud Run
[Introduction to service identity](https://docs.cloud.google.com/run/docs/securing/service-identity.md.txt) guide.

## Add a user-managed service account at deployment

When deploying a function using `gcloud functions deploy`, add the
`--service-account` flag. For example:

```bash
gcloud functions deploy FUNCTION_NAME --service-account SERVICE_ACCOUNT_EMAIL
```

Replace `FUNCTION_NAME` with your function name, and
`SERVICE_ACCOUNT_EMAIL` with the service account
email.

## Update the service account of an existing function

You can update the runtime service account of an existing function.

When deploying a function using `gcloud functions deploy`, add the
`--service-account` flag:

```bash
gcloud functions deploy FUNCTION_NAME --service-account SERVICE_ACCOUNT_EMAIL
```

Replace `FUNCTION_NAME` with your function name, and
`SERVICE_ACCOUNT_EMAIL` with the service account.

The redeployed function now uses the new runtime service account.