Stay organized with collections
Save and categorize content based on your preferences.
App Engine apps require a service account in order to access other Google Cloud
services and execute tasks. By default, the
App Engine default service account
is used as the identity of your App Engine app. You may also specify a
different user-managed service
account to be used as the
identity for a specific version of your App Engine app. This allows you
to grant different privileges to each version, based on the specific tasks it
performs, and avoid granting more privileges than necessary.
This guide covers how to specify a different user-managed service account when
deploying a new version. If you don't need to create a distinct service account
when deploying a specific version of your app, you can continue to use the
default service account by not specifying a service account.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-03-05 UTC."],[[["App Engine apps use a service account to access other Google Cloud services, with the option to use the default or a user-managed service account."],["User-managed service accounts allow for granting specific privileges to each App Engine app version, enhancing security by limiting unnecessary access."],["A user-managed service account can be created by following the linked instructions, and IAM roles can be granted based on the App Engine roles documentation."],["When deploying an app version, a user-managed service account can be specified via the `gcloud app deploy` command or within the `app.yaml` file."],["The App Engine standard environment service agent should not be removed, as it is essential for delegating user-managed service accounts and preventing IAM permission errors."]]],[]]
