Permission denied during gcloud app deploy using Google Cloud SDK

Question

It is insanely hard, to deploy an app to Google App Engine, using Google Cloud SDK.

I had tried the below 2 commands

C:\Users\yccheok\Desktop\jstock-android-appengine>gcloud config set project jstock-android
Updated property [core/project].

C:\Users\yccheok\Desktop\jstock-android-appengine>gcloud app deploy app.yaml --log-http --verbosity=debug
DEBUG: Running [gcloud.app.deploy] with arguments: [--log-http: "true", --verbosity: "debug", DEPLOYABLES:1: "['app.yaml']"]
DEBUG: No staging command found for runtime [python27] and environment [STANDARD].
DEBUG: API endpoint: [https://appengine.googleapis.com/], API version: [v1]
=======================
==== request start ====
uri: https://appengine.googleapis.com/v1/apps/jstock-android?alt=json
method: GET
== headers start ==
Authorization: Bearer ya29.GlxEBb1XVP1JK93-ARiaN_ZgiMbvZmw5KWfvJVfibDJ4FK_ZaMRoU1jVDTiWzsY606GSduJKJd9Nm8zA-_Iql5mGn4AMk4QVl8mPRycfekeZnOOHtbUvpkBMgOLOQA
accept: application/json
accept-encoding: gzip, deflate
content-length: 0
user-agent: google-cloud-sdk x_Tw5K8nnjoRAqULM9PFAC2b gcloud/184.0.0 command/gcloud.app.deploy invocation-id/c9ae232d33b346d787b95a36e28c38c0 environment/None environment-version/None interactive/True python/2.7.13 (Windows NT 10.0.16299)
== headers end ==
== body start ==

== body end ==
==== request end ====
---- response start ----
-- headers start --
-content-encoding: gzip
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
cache-control: private
content-length: 335
content-type: application/json; charset=UTF-8
date: Tue, 16 Jan 2018 19:16:21 GMT
server: ESF
status: 403
transfer-encoding: chunked
vary: Origin, X-Origin, Referer
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
-- headers end --
-- body start --
{
  "error": {
    "code": 403,
    "message": "Operation not allowed",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ResourceInfo",
        "resourceType": "gae.api",
        "description": "The \"appengine.applications.get\" permission is required."
      }
    ]
  }
}

-- body end --
total round trip time (request+response): 1.796 secs
---- response end ----
----------------------
DEBUG: (gcloud.app.deploy) Permissions error fetching application [apps/jstock-android]. Please make sure you are using the correct project ID and that you have permission to view applications on the project.
Traceback (most recent call last):
  File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\calliope\cli.py", line 797, in Execute
    resources = calliope_command.Run(cli=self, args=args)
  File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\calliope\backend.py", line 757, in Run
    resources = command_instance.Run(args)
  File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\surface\app\deploy.py", line 65, in Run
    parallel_build=False)
  File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\command_lib\app\deploy_util.py", line 543, in RunDeploy
    app = _PossiblyCreateApp(api_client, project)
  File "C:\Program Files (x86)\Google\Cloud SDK\google-cloud-sdk\lib\googlecloudsdk\command_lib\app\deploy_util.py", line 703, in _PossiblyCreateApp
    api_client._FormatApp())))  # pylint: disable=protected-access
HttpException: Permissions error fetching application [apps/jstock-android]. Please make sure you are using the correct project ID and that you have permission to view applications on the project.
ERROR: (gcloud.app.deploy) Permissions error fetching application [apps/jstock-android]. Please make sure you are using the correct project ID and that you have permission to view applications on the project.

C:\Users\yccheok\Desktop\jstock-android-appengine>

Then, I went through https://cloud.google.com/appengine/docs/admin-api/accessing-the-api , it mentioned I need to use Admin API. So, I do it step by step carefully.

Step 1

Step 2

It mentions Admin API is enabled. Now I need credential.

Step 3

Step 4

OK. Now they mention I don't need create new credential. I can use Application Default Credentials ?!

Step 5

So, I went to https://developers.google.com/identity/protocols/application-default-credentials?hl=en_GB . I learn that I need to run

C:\Users\yccheok\Desktop\jstock-android-appengine>gcloud auth application-default login
Your browser has been opened to visit:

    https://accounts.google.com/o/oauth2/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8085%2F&prompt=select_account&response_type=code&client_id=764086051850-6qr4p6gpi6hn506pt8ejuq83di341hur.apps.googleusercontent.com&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fcloud-platform&access_type=offline



Credentials saved to file: [C:\Users\yccheok\AppData\Roaming\gcloud\application_default_credentials.json]

These credentials will be used by any library that requests
Application Default Credentials.

Step 6

Step 7

Still, after completing the above 7 steps, I still get the exact same error message, when trying to run

gcloud app deploy app.yaml --log-http --verbosity=debug

Can anyone let me know, what step I'm still require, in order to deploy my Python app to Google App Engine, using Google Cloud SDK?

Dan Cornilescu · Accepted Answer · 2018-01-16 20:40:13Z

16

The Admin API is for programmatically deploying the app, not for deploying using gcloud app deploy, for which you don't even need the Admin API enabled for your app.

From Deploying a Python App:

To programmatically deploy your apps, use the Admin API.

Before you begin

Before you can deploy your app:

The Owner of the GCP project must create the App Engine application.

Ensure that your user account includes the required privileges.

(but I can see how the above could be mis-intrepreted as an invitation to use the Admin API)

Most likely the account actually used by gcloud app deploy is missing or doesn't have the required permissions.

You can check the acount used with gcloud auth list. In my case the account is my email address, not a service account (I'm not sure if a service account can be used).

Use gcloud auth login (and maybe gcloud auth revoke) if you need a different account.

And you can check the account's privileges (if any) on the project/app on the IAM Page.

answered Jan 16, 2018 at 20:40

Dan Cornilescu

39.8k12 gold badges61 silver badges102 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Lindauson Over a year ago

Revoking access was key to remove the authentication for another project.

John Mann · Accepted Answer · 2018-07-11 19:21:04Z

6

One additional note on this, When you enable the App Engine API and the cloud builder api, make sure the Cloud Build Service Account also has access to the project.

I ran into that problem after enabling the correct apis.

This was using a build trigger. I could deploy locally from a command line because I was authenticated as myself. However, if you are using a build trigger, it will use the build service account, which needs access.

Hope this helps.

answered Jul 11, 2018 at 19:21

John Mann

1933 silver badges8 bronze badges

4 Comments

jub0bs Over a year ago

Your answer helped me home in on my problem: my default Cloud Build Service Account was missing the "App Engine Deployer" role. Thanks!

Govind Rai Over a year ago

This was the problem! You would probably also want to give "App Engine Service Admin" role to the cloud build service account if you want cloud build to be able to promote the service to the latest version or engage in traffic splitting.

ahong Over a year ago

@GovindRai but gcloud app deploy should still work? or do you mean only gcloud app deploy --no-promote will work?

Govind Rai Over a year ago

That’s a great question. I am not fully sure but possibly —no-promote should work as it is only deploying and not splitting traffic. Try it out?

Claytronicon · Accepted Answer · 2018-08-07 18:31:58Z

5

I had this issue. In my case it was solved by setting the project using the project ID, rather than the project name. See this answer

gcloud app deploy ERROR: Permissions error fetching application [apps/<PROJECT_NAME>]

answered Aug 7, 2018 at 18:31

Claytronicon

1,45613 silver badges14 bronze badges

1 Comment

Saurav Panda Over a year ago

replacing the project name with project id worked for me, thank you!

Collectives™ on Stack Overflow

Permission denied during gcloud app deploy using Google Cloud SDK

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

Step 7

3 Answers 3

1 Comment

4 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

Step 7

3 Answers 3

1 Comment

4 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related