Roles that grant access to App Engine

Roles determine which services and actions are available to a user account or service account. The following types of roles grant access to App Engine:

  • Basic roles which apply to all services and resources in a project, including but not limited App Engine. For example, an account with the Editor role can change App Engine settings as well as Cloud Storage settings.

  • Predefined App Engine roles, which provide granular access to App Engine. Each service in your Google Cloud project provides its own predefined roles. For example, an account that only has the App Engine Deployer role can deploy App Engine apps but cannot view or create objects in Cloud Storage. Such an account would also need a specific Cloud Storage predefined role to create or view objects in Cloud Storage.

  • Custom roles, which provide granular access according to a list of permissions you specify.

You can use basic roles when you are working on smaller projects that have less complex needs. For more fine-tuned access controls, use predefined roles.

Basic roles

Basic roles apply to all services and resources in a project. For example, an account in the Editor role can change App Engine settings as well as Cloud Storage settings.

Role Google Cloud console permissions Tools permissions
Owner Required to create App Engine applications. All viewer and editor privileges, plus the ability to view deployed source code, invite users, change user roles, and delete an application. Required to create App Engine applications. Can also deploy application code and update all configurations.
Editor View application information and edit application settings. Deploy application code, update indexes/queues/crons.
Viewer View application information. Request logs

Predefined App Engine roles

Role Permissions

(roles/appengine.admin)

Admin role for appengine

appengine.*

  • appengine.applications.create
  • appengine.applications.get
  • appengine.applications.listRuntimes
  • appengine.applications.update
  • appengine.instances.delete
  • appengine.instances.enableDebug
  • appengine.instances.get
  • appengine.instances.list
  • appengine.memcache.addKey
  • appengine.memcache.flush
  • appengine.memcache.get
  • appengine.memcache.getKey
  • appengine.memcache.list
  • appengine.memcache.update
  • appengine.operations.get
  • appengine.operations.list
  • appengine.runtimes.actAsAdmin
  • appengine.services.delete
  • appengine.services.get
  • appengine.services.list
  • appengine.services.update
  • appengine.versions.create
  • appengine.versions.delete
  • appengine.versions.exportAppImage
  • appengine.versions.get
  • appengine.versions.getFileContents
  • appengine.versions.list
  • appengine.versions.update

resourcemanager.projects.get

resourcemanager.projects.list

(roles/appengine.appAdmin)

Read/Write/Modify access to all application configuration and settings.

To deploy new versions, a principal must have the Service Account User (roles/iam.serviceAccountUser) role on the assigned App Engine service account, and the Cloud Build Editor (roles/cloudbuild.builds.editor), and Cloud Storage Object Admin (roles/storage.objectAdmin) roles on the project.

Lowest-level resources where you can grant this role:

  • Project

appengine.applications.get

appengine.applications.listRuntimes

appengine.applications.update

appengine.instances.*

  • appengine.instances.delete
  • appengine.instances.enableDebug
  • appengine.instances.get
  • appengine.instances.list

appengine.memcache.addKey

appengine.memcache.flush

appengine.memcache.get

appengine.memcache.update

appengine.operations.*

  • appengine.operations.get
  • appengine.operations.list

appengine.runtimes.actAsAdmin

appengine.services.*

  • appengine.services.delete
  • appengine.services.get
  • appengine.services.list
  • appengine.services.update

appengine.versions.create

appengine.versions.delete

appengine.versions.exportAppImage

appengine.versions.get

appengine.versions.list

appengine.versions.update

artifactregistry.projectsettings.get

artifactregistry.repositories.deleteArtifacts

artifactregistry.repositories.downloadArtifacts

artifactregistry.repositories.uploadArtifacts

recommender.appengineVersionCostInsights.*

  • recommender.appengineVersionCostInsights.get
  • recommender.appengineVersionCostInsights.list
  • recommender.appengineVersionCostInsights.update

recommender.appengineVersionCostRecommendations.*

  • recommender.appengineVersionCostRecommendations.get
  • recommender.appengineVersionCostRecommendations.list
  • recommender.