What permission is required for a service account to deploy to Google App Engine using gcloud?

Question

I have created a service account in order to deploy a project to google app engine.

The service account I have created has these two roles:

1. App Engine -> App Engine Deployer
2. Storage -> Storage Object Admin

I downloaded the json key file, and then run these commands:

gcloud auth activate-service-account --key-file key.json
gcloud -q app deploy app_deploy.yaml --version 1.0 --promote

I got this error message:

ERROR: (gcloud.app.deploy) Error Response: [403] Operation not allowed

Details: [
  [
    {
      "@type": "type.googleapis.com/google.rpc.ResourceInfo",
      "description": "The \"appengine.applications.get\" permission is required.",
      "resourceType": "gae.api"
    }
  ]
]

What role did I miss to add?

Answer 1

As of January 2020, the documentation for App Engine Roles states:

Note: The App Engine Deployer (roles/appengine.deployer) role alone grants adequate permission to deploy using the App Engine Admin API. To use other App Engine tooling, like gcloud commands, you must also have the Compute Storage Admin (roles/compute.storageAdmin) and Cloud Build Editor (cloudbuild.builds.editor) roles.

However, this is not completely true:

1. The cloudbuild.builds.editor is not sufficient (I suspect an error in the doc here). Indeed, the CLI apparently needs the storage.objects.list permission which is provided by cloudbuild.builds.builder.
2. After deployment, you'll get an error because you don't have permission to change traffic splits. Thus, you need roles/appengine.serviceAdmin.

So, here is the roles list that worked for me:

• roles/appengine.deployer
• roles/appengine.serviceAdmin
• roles/compute.storageAdmin
• roles/cloudbuild.builds.builder