Do not have permission to access app while deploying google service account

google-app-engine deployment service-accounts
npr picture npr · Sep 20, 2016 · Viewed 30.2k times · Source

After creating google service account with permission as shown below - deployment fails with message . I am failing to understand where this is going wrong.

====

$ gcloud iam service-accounts get-iam-policy [email protected]
bindings:
- members:
  - serviceAccount:[email protected]
  role: roles/owner
etag: Bxxxxxxxxg=

====

$ gcloud auth activate-service-account --key-file ../a.json 
Activated service account credentials for: [[email protected]]

$ gcloud app deploy
ERROR: (gcloud.app.deploy) You do not have permission to access app [appid].

Answer

m.spyratos picture m.spyratos · Feb 3, 2019

For those who are trying to deploy using a service account and the gcloud commands, you will need to set all of the following roles:

  • App Engine Deployer (deploy new code)
  • Storage Object Viewer (list images)
  • Storage Object Creator (upload the image)
  • Cloud Build Editor (create build)
  • App Engine Service Admin (promoting the new version)

From the access control docs:

The App Engine Deployer role alone grants adequate permission to deploy using the Admin API. To use other App Engine tooling, like gcloud commands, you must also have the Storage Admin role and Cloud Build Editor role.

Related questions

How do I manage third-party Python libraries with Google App Engine? (virtualenv? pip?)

What's the best strategy for managing third-party Python libraries with Google App Engine? Say I want to use Flask, a webapp framework. A blog entry says to do this, which doesn't seem right: $ cd /tmp/ $ wget http://pypi.python.org/…

Read More
How to set up a staging environment on Google App Engine

Having properly configured a Development server and a Production server, I would like to set up a Staging environment on Google App Engine useful to test new developed versions live before deploying them to production. I know two different approaches: …

Read More
How can I have Google App Engine clear memcache every time a site is deployed?

The title asks it all. The content on the site I'm building wont change very quickly at all and so Memcache could potentially store data for months except for when I put up an update. Is there a way to …

Read More