授予 App Engine 访问权限的角色

角色决定了哪些服务和操作可供某一用户账号或服务账号使用。以下类型的角色可授予对 App Engine 的访问权限：

  • 基本角色：适用于项目中的所有服务和资源，包括但不限于 App Engine。例如，具有 Editor 角色的账号可以更改 App Engine 设置以及 Cloud Storage 设置。

  • 预定义 App Engine 角色，提供对 App Engine 的精细访问权限。您的Google Cloud 项目中的每项服务都具有自己的预定义角色。例如，仅具有 App Engine Deployer 角色的账号可以部署 App Engine 应用，但无法在 Cloud Storage 中查看或创建对象。此类账号还需要具有特定的 Cloud Storage 预定义角色才能在 Cloud Storage 中创建或查看对象。

  • 自定义角色：根据您指定的权限列表提供精细访问权限。

在处理需求不太复杂的小型项目时，您可以使用基本角色。如需实现更精细的访问权限控制，请使用预定义角色。

基本角色

基本角色适用于项目中的所有服务和资源。例如，具有 Editor 角色的账号可以更改 App Engine 设置以及 Cloud Storage 设置。

角色 Google Cloud 控制台权限 工具权限
Owner 如需创建 App Engine 应用，必须具有此角色。该角色拥有 Viewer 和 Editor 的所有权限，还可以查看已部署的源代码、邀请用户、更改用户角色以及删除应用。 如需创建 App Engine 应用，必须具有此角色。还可以部署应用代码和更新所有配置。
Editor 该角色可以查看应用信息和修改应用设置。 该角色可以部署应用代码以及更新索引/队列/Cron。
Viewer 该角色可以查看应用信息。 该角色可以请求日志

预定义 App Engine 角色

Role Permissions

(roles/appengine.admin)

Admin role for appengine

appengine.*

  • appengine.applications.create
  • appengine.applications.get
  • appengine.applications.listRuntimes
  • appengine.applications.update
  • appengine.instances.delete
  • appengine.instances.enableDebug
  • appengine.instances.get
  • appengine.instances.list
  • appengine.memcache.addKey
  • appengine.memcache.flush
  • appengine.memcache.get
  • appengine.memcache.getKey
  • appengine.memcache.list
  • appengine.memcache.update
  • appengine.operations.get
  • appengine.operations.list
  • appengine.runtimes.actAsAdmin
  • appengine.services.delete
  • appengine.services.get
  • appengine.services.list
  • appengine.services.update
  • appengine.versions.create
  • appengine.versions.delete
  • appengine.versions.exportAppImage
  • appengine.versions.get
  • appengine.versions.getFileContents
  • appengine.versions.list
  • appengine.versions.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/appengine.appAdmin)

Read/Write/Modify access to all application configuration and settings.

To deploy new versions, a principal must have the Service Account User (roles/iam.serviceAccountUser) role on the assigned App Engine service account, and the Cloud Build Editor (roles/cloudbuild.builds.editor), and Cloud Storage Object Admin (roles/storage.objectAdmin) roles on the project.

Lowest-level resources where you can grant this role:

  • Project

appengine.applications.get

appengine.applications.listRuntimes

appengine.applications.update

appengine.instances.*

  • appengine.instances.delete
  • appengine.instances.enableDebug
  • appengine.instances.get
  • appengine.instances.list

appengine.memcache.addKey

appengine.memcache.flush

appengine.memcache.get

appengine.memcache.update

appengine.operations.*

  • appengine.operations.get
  • appengine.operations.list

appengine.runtimes.actAsAdmin

appengine.services.*

  • appengine.services.delete
  • appengine.services.get
  • appengine.services.list
  • appengine.services.update

appengine.versions.create

appengine.versions.delete

appengine.versions.exportAppImage

appengine.versions.get

appengine.versions.list

appengine.versions.update

artifactregistry.projectsettings.get

artifactregistry.repositories.deleteArtifacts

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.uploadArtifacts

recommender.appengineVersionCostInsights.*

  • recommender.appengineVersionCostInsights.get
  • recommender.appengineVersionCostInsights.list
  • recommender.appengineVersionCostInsights.update

recommender.appengineVersionCostRecommendations.*

  • recommender.appengineVersionCostRecommendations.get
  • recommender.appengineVersionCostRecommendations.list
  • recommender.appengineVersionCostRecommendations.update

recommender.locations.*

  • recommender.locations.get
  • recommender.locations.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/appengine.editor)

Editor role for appengine

appengine.applications.get

appengine.applications.listRuntimes

appengine.applications.update

appengine.instances.*

  • appengine.instances.delete
  • appengine.instances.enableDebug
  • appengine.instances.get
  • appengine.instances.list

appengine.memcache.*

  • appengine.memcache.addKey
  • appengine.memcache.flush
  • appengine.memcache.get
  • appengine.memcache.getKey
  • appengine.memcache.list
  • appengine.memcache.update

appengine.operations.*

  • appengine.operations.get
  • appengine.operations.list

appengine.runtimes.actAsAdmin

appengine.services.*

  • appengine.services.delete
  • appengine.services.get
  • appengine.services.list
  • appengine.services.update

appengine.versions.create

appengine.versions.delete

appengine.versions.exportAppImage

appengine.versions.get

appengine.versions.list

appengine.versions.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/appengine.viewer)

Viewer role for appengine

appengine.applications.get

appengine.applications.listRuntimes

appengine.instances.get

appengine.instances.list

appengine.memcache.get

appengine.memcache.getKey

appengine.memcache.list

appengine.operations.*

  • appengine.operations.get
  • appengine.operations.list

appengine.runtimes.actAsAdmin

appengine.services.get

appengine.services.list

appengine.versions.get

appengine.versions.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/appengine.appCreator)

Ability to create the App Engine resource for the project.

Lowest-level resources where you can grant this role:

  • Project

appengine.applications.create

resourcemanager.projects.get

resourcemanager.projects.list

(roles/appengine.appViewer)

Read-only access to all application configuration and settings.

Lowest-level resources where you can grant this role:

  • Project

appengine.applications.get

appengine.applications.listRuntimes

appengine.instances.get

appengine.instances.list

appengine.operations.*

  • appengine.operations.get
  • appengine.operations.list

appengine.services.get

appengine.services.list

appengine.versions.get

appengine.versions.list

artifactregistry.projectsettings.get

recommender.appengineVersionCostInsights.get

recommender.appengineVersionCostInsights.list

recommender.appengineVersionCostRecommendations.get

recommender.appengineVersionCostRecommendations.list

recommender.locations.*

  • recommender.locations.get
  • recommender.locations.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/appengine.codeViewer)

Read-only access to all application configuration, settings, and deployed source code.

Lowest-level resources where you can grant this role:

  • Project

appengine.applications.get

appengine.applications.listRuntimes

appengine.instances.get

appengine.instances.list

appengine.operations.*

  • appengine.operations.get
  • appengine.operations.list

appengine.services.get

appengine.services.list

appengine.versions.get

appengine.versions.getFileContents

appengine.versions.list

artifactregistry.projectsettings.get

resourcemanager.projects.get

resourcemanager.projects.list

(roles/appengine.debugger)

Ability to read or manage v2 instances.

appengine.applications.get

appengine.applications.listRuntimes

appengine.instances.*

  • appengine.instances.delete
  • appengine.instances.enableDebug
  • appengine.instances.get
  • appengine.instances.list

appengine.operations.*

  • appengine.operations.get
  • appengine.operations.list

appengine.services.get

appengine.services.list

appengine.versions.get

appengine.versions.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/appengine.deployer)

Read-only access to all application configuration and settings.

To deploy new versions, you must also have the Service Account User (roles/iam.serviceAccountUser) role on the assigned App Engine service account, and the Cloud Build Editor (roles/cloudbuild.builds.editor), and Cloud Storage Object Admin (roles/storage.objectAdmin) roles on the project.

Cannot modify existing versions other than deleting versions that are not receiving traffic.

Lowest-level resources where you can grant this role:

  • Project

appengine.applications.get

appengine.applications.listRuntimes

appengine.instances.get

appengine.instances.list

appengine.operations.*

  • appengine.operations.get
  • appengine.operations.list

appengine.services.get

appengine.services.list

appengine.versions.create

appengine.versions.delete

appengine.versions.exportAppImage

appengine.versions.get

appengine.versions.list

artifactregistry.projectsettings.get

artifactregistry.repositories.deleteArtifacts

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.uploadArtifacts

recommender.appengineVersionCostInsights.*

  • recommender.appengineVersionCostInsights.get
  • recommender.appengineVersionCostInsights.list
  • recommender.appengineVersionCostInsights.update

recommender.appengineVersionCostRecommendations.*

  • recommender.appengineVersionCostRecommendations.get
  • recommender.appengineVersionCostRecommendations.list
  • recommender.appengineVersionCostRecommendations.update

recommender.locations.*

  • recommender.locations.get
  • recommender.locations.list

resourcemanager.projects.get

resourcemanager.projects.list

(roles/appengine.memcacheDataAdmin)

Can get, set, delete, and flush App Engine Memcache items.

appengine.applications.get

appengine.memcache.addKey

appengine.memcache.flush

appengine.memcache.get

appengine.memcache.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/appengine.serviceAdmin)

Read-only access to all application configuration and settings.

Write access to module-level and version-level settings. Cannot deploy a new version.

Lowest-level resources where you can grant this role:

  • Project

appengine.applications.get

appengine.applications.listRuntimes

appengine.instances.delete

appengine.instances.get

appengine.instances.list

appengine.operations.*

  • appengine.operations.get
  • appengine.operations.list

appengine.services.*

  • appengine.services.delete
  • appengine.services.get
  • appengine.services.list
  • appengine.services.update

appengine.versions.delete

appengine.versions.get

appengine.versions.list

appengine.versions.update

artifactregistry.projectsettings.get

recommender.appengineVersionCostInsights.*

  • recommender.appengineVersionCostInsights.get
  • recommender.appengineVersionCostInsights.list
  • recommender.appengineVersionCostInsights.update

recommender.appengineVersionCostRecommendations.*

  • recommender.appengineVersionCostRecommendations.get
  • recommender.appengineVersionCostRecommendations.list
  • recommender.appengineVersionCostRecommendations.update

recommender.locations.*

  • recommender.locations.get
  • recommender.locations.list

resourcemanager.projects.get

resourcemanager.projects.list

Service agent roles

Service agent roles should only be granted to service agents.

Role Permissions

(roles/appengine.serviceAgent)

Give App Engine Standard Envirnoment service account access to managed resources. Includes access to service accounts.

appengine.versions.delete

appengine.versions.get

appengine.versions.list

appengine.versions.update

artifactregistry.aptartifacts.create

artifactregistry.dockerimages.*

  • artifactregistry.dockerimages.get
  • artifactregistry.dockerimages.list

artifactregistry.files.download

artifactregistry.files.get

artifactregistry.files.list

artifactregistry.kfpartifacts.create

artifactregistry.locations.*

  • artifactregistry.locations.get
  • artifactregistry.locations.list

artifactregistry.mavenartifacts.*

  • artifactregistry.mavenartifacts.get
  • artifactregistry.mavenartifacts.list

artifactregistry.npmpackages.*

  • artifactregistry.npmpackages.get
  • artifactregistry.npmpackages.list

artifactregistry.packages.get

artifactregistry.packages.list

artifactregistry.projectsettings.get