Python 2.7 telah mencapai akhir dukungan
dan akan dihentikan penggunaannya
pada 31 Januari 2026. Setelah penghentian penggunaan, Anda tidak akan dapat men-deploy aplikasi Python 2.7, meskipun organisasi Anda sebelumnya menggunakan kebijakan organisasi untuk mengaktifkan kembali deployment runtime lama. Aplikasi Python 2.7 yang ada akan terus berjalan dan menerima traffic setelah
tanggal penghentiannya. Sebaiknya Anda bermigrasi ke versi Python terbaru yang didukung.
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Peran menentukan layanan dan tindakan yang tersedia untuk akun pengguna atau akun layanan. Jenis peran berikut memberikan akses ke App Engine:
Peran dasar yang berlaku untuk semua layanan dan resource dalam suatu project, termasuk tapi tidak terbatas pada App Engine. Misalnya, akun dengan peran Editor dapat mengubah setelan App Engine dan setelan Cloud Storage.
Peran bawaan App Engine, yang menyediakan akses terperinci ke App Engine. Setiap layanan dalam projectGoogle Cloud Anda menyediakan peran bawaannya sendiri. Misalnya, akun yang hanya memiliki peran App Engine Deployer dapat men-deploy aplikasi App Engine, tetapi tidak dapat melihat atau membuat objek di Cloud Storage. Akun tersebut juga memerlukan peran bawaan Cloud Storage tertentu untuk membuat atau melihat objek di Cloud Storage.
Peran khusus,
yang memberikan akses terperinci sesuai dengan daftar izin yang Anda tentukan.
Anda dapat menggunakan peran dasar saat mengerjakan project kecil yang memiliki
kebutuhan yang tidak terlalu kompleks. Untuk kontrol akses yang lebih disesuaikan, gunakan peran bawaan.
Peran dasar
Peran dasar berlaku untuk semua layanan dan resource dalam sebuah project. Misalnya, akun dalam peran Editor dapat mengubah setelan App Engine dan setelan Cloud Storage.
Peran
Google Cloud izin konsol
Izin alat
Owner
Diperlukan untuk membuat aplikasi App Engine. Semua hak istimewa
viewer dan editor, serta kemampuan untuk melihat
kode sumber yang di-deploy, mengundang pengguna, mengubah peran pengguna, dan menghapus aplikasi.
Memiliki hak istimewa
admin untuk semua resource dalam project.
Diperlukan untuk membuat aplikasi App Engine. Juga dapat men-deploy
kode aplikasi dan mengupdate semua konfigurasi.
Editor
Melihat informasi aplikasi dan mengedit setelan aplikasi.
Memiliki hak istimewa
admin untuk semua resource dalam project.
Men-deploy kode aplikasi, memperbarui indeks/antrean/cron.
Viewer
Melihat informasi aplikasi.
Memiliki hak istimewa
admin untuk semua resource dalam project.
Log permintaan
Peran bawaan App Engine
Role
Permissions
App Engine Admin
(roles/appengine.appAdmin)
Read/Write/Modify access to all application configuration and settings.
To deploy new versions, a principal must have the
Service Account User
(roles/iam.serviceAccountUser) role on the assigned App Engine
service account, and the Cloud Build Editor
(roles/cloudbuild.builds.editor), and Cloud Storage Object Admin
(roles/storage.objectAdmin) roles on the project.
Lowest-level resources where you can grant this role:
Project
appengine.applications.get
appengine.applications.listRuntimes
appengine.applications.update
appengine.instances.*
appengine.instances.delete
appengine.instances.enableDebug
appengine.instances.get
appengine.instances.list
appengine.memcache.addKey
appengine.memcache.flush
appengine.memcache.get
appengine.memcache.update
appengine.operations.*
appengine.operations.get
appengine.operations.list
appengine.runtimes.actAsAdmin
appengine.services.*
appengine.services.delete
appengine.services.get
appengine.services.list
appengine.services.update
appengine.versions.create
appengine.versions.delete
appengine.versions.get
appengine.versions.list
appengine.versions.update
artifactregistry.projectsettings.get
artifactregistry.repositories.deleteArtifacts
artifactregistry.repositories.downloadArtifacts
artifactregistry.repositories.uploadArtifacts
resourcemanager.projects.get
resourcemanager.projects.list
App Engine Creator
(roles/appengine.appCreator)
Ability to create the App Engine resource for the project.
Lowest-level resources where you can grant this role:
Project
appengine.applications.create
resourcemanager.projects.get
resourcemanager.projects.list
App Engine Viewer
(roles/appengine.appViewer)
Read-only access to all application configuration and settings.
Lowest-level resources where you can grant this role:
Project
appengine.applications.get
appengine.applications.listRuntimes
appengine.instances.get
appengine.instances.list
appengine.operations.*
appengine.operations.get
appengine.operations.list
appengine.services.get
appengine.services.list
appengine.versions.get
appengine.versions.list
artifactregistry.projectsettings.get
resourcemanager.projects.get
resourcemanager.projects.list
App Engine Code Viewer
(roles/appengine.codeViewer)
Read-only access to all application configuration, settings, and deployed
source code.
Lowest-level resources where you can grant this role:
Project
appengine.applications.get
appengine.applications.listRuntimes
appengine.instances.get
appengine.instances.list
appengine.operations.*
appengine.operations.get
appengine.operations.list
appengine.services.get
appengine.services.list
appengine.versions.get
appengine.versions.getFileContents
appengine.versions.list
artifactregistry.projectsettings.get
resourcemanager.projects.get
resourcemanager.projects.list
App Engine Managed VM Debug Access
(roles/appengine.debugger)
Ability to read or manage v2 instances.
appengine.applications.get
appengine.applications.listRuntimes
appengine.instances.*
appengine.instances.delete
appengine.instances.enableDebug
appengine.instances.get
appengine.instances.list
appengine.operations.*
appengine.operations.get
appengine.operations.list
appengine.services.get
appengine.services.list
appengine.versions.get
appengine.versions.list
resourcemanager.projects.get
resourcemanager.projects.list
App Engine Deployer
(roles/appengine.deployer)
Read-only access to all application configuration and settings.
To deploy new versions, you must also have the
Service Account User
(roles/iam.serviceAccountUser) role on the assigned App Engine
service account, and the Cloud
Build Editor (roles/cloudbuild.builds.editor), and Cloud Storage Object Admin
(roles/storage.objectAdmin) roles on the project.
Cannot modify existing versions other than deleting versions that are not receiving traffic.
Lowest-level resources where you can grant this role:
Project
appengine.applications.get
appengine.applications.listRuntimes
appengine.instances.get
appengine.instances.list
appengine.operations.*
appengine.operations.get
appengine.operations.list
appengine.services.get
appengine.services.list
appengine.versions.create
appengine.versions.delete
appengine.versions.get
appengine.versions.list
artifactregistry.projectsettings.get
artifactregistry.repositories.deleteArtifacts
artifactregistry.repositories.downloadArtifacts
artifactregistry.repositories.uploadArtifacts
resourcemanager.projects.get
resourcemanager.projects.list
App Engine Memcache Data Admin
(roles/appengine.memcacheDataAdmin)
Can get, set, delete, and flush App Engine Memcache items.
appengine.applications.get
appengine.memcache.addKey
appengine.memcache.flush
appengine.memcache.get
appengine.memcache.update
resourcemanager.projects.get
resourcemanager.projects.list
App Engine Service Admin
(roles/appengine.serviceAdmin)
Read-only access to all application configuration and settings.
Write access to module-level and version-level settings. Cannot deploy a new version.
Lowest-level resources where you can grant this role:
Project
appengine.applications.get
appengine.applications.listRuntimes
appengine.instances.delete
appengine.instances.get
appengine.instances.list
appengine.operations.*
appengine.operations.get
appengine.operations.list
appengine.services.*
appengine.services.delete
appengine.services.get
appengine.services.list
appengine.services.update
appengine.versions.delete
appengine.versions.get
appengine.versions.list
appengine.versions.update
artifactregistry.projectsettings.get
resourcemanager.projects.get
resourcemanager.projects.list
App Engine Standard Environment Service Agent
(roles/appengine.serviceAgent)
Give App Engine Standard Envirnoment service account access to managed resources. Includes access to service accounts.
Peran bawaan untuk App Engine memberi Anda opsi yang lebih terperinci untuk kontrol akses.
Peran ini hanya memberikan akses ke App Engine. Jika project Anda menyertakan
layanan lain, seperti Cloud Storage atau Cloud SQL, Anda harus menetapkan
peran tambahan untuk mengaktifkan akses ke layanan lain.
Perbandingan peran bawaan App Engine
Tabel berikut memberikan perbandingan lengkap dari kemampuan setiap peran bawaan App Engine.
Kemampuan
App Engine Admin
App Engine Service Admin
App Engine Deployer
App Engine Viewer
App Engine Code Viewer
Membuat daftar dari semua layanan, versi, dan instance
Ya
Ya
Ya
Ya
Ya
Melihat semua setelan aplikasi, layanan, versi, dan instance
Ya
Ya
Ya
Ya
Ya
Melihat metrik runtime seperti penggunaan resource, informasi pemuatan, dan informasi error
Ya
Ya
Ya
Ya
Ya
Melihat kode sumber aplikasi
Tidak
Tidak
Tidak
Tidak
Ya
Men-deploy versi baru aplikasi
Ya, jika Anda juga memberikan peran Service Account User
Tidak
Ya, jika Anda juga memberikan peran Service Account User
Untuk mengetahui detail tentang cara memberikan izin yang diperlukan, lihat Membuat akun pengguna.
Pemisahan tugas deployment dan pemilihan rute traffic
Banyak organisasi lebih suka memisahkan tugas men-deploy versi aplikasi dari tugas meningkatkan traffic ke versi yang baru dibuat, dan agar tugas ini dilakukan oleh fungsi tugas yang berbeda. Peran App Engine Deployer dan App Engine Admin Service menyediakan pemisahan ini:
Peran App Engine Deployer plus Service Account User - Akun dibatasi untuk men-deploy versi baru dan menghapus versi lama yang tidak menyalurkan traffic.
Akun dengan peran ini tidak akan dapat mengonfigurasi traffic ke versi apa pun, dan juga tidak dapat mengubah setelan tingkat aplikasi seperti aturan dispatch atau domain autentikasi.
Peran App Engine Service Admin - Akun tidak dapat men-deploy versi baru aplikasi atau mengubah setelan tingkat aplikasi. Namun, akun tersebut memiliki hak istimewa untuk mengubah properti layanan dan versi yang ada, termasuk mengubah versi yang dapat menyalurkan traffic. Peran App Engine Service Admin cocok untuk departemen IT/Operasi yang menangani peningkatan traffic ke versi yang baru di-deploy.
Batasan peran bawaan
Peran bawaan App Engine tidak memberikan akses ke hal berikut:
Melihat dan mendownload log aplikasi.
Melihat diagram Monitoring di Google Cloud konsol.
Mengaktifkan dan Menonaktifkan penagihan.
Jalankan pemindaian keamanan di Cloud Security Scanner.
Mengakses konfigurasi atau data yang disimpan di Datastore, Task Queues, Cloud Search, atau produk penyimpanan Cloud Platform lainnya.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-25 UTC."],[[["\u003cp\u003eRoles determine the services and actions available to user or service accounts within App Engine, including basic roles for all project services, predefined roles for specific App Engine access, and custom roles for tailored permissions.\u003c/p\u003e\n"],["\u003cp\u003eBasic roles like Owner, Editor, and Viewer apply broadly across all services in a project, allowing actions in App Engine as well as services like Cloud Storage.\u003c/p\u003e\n"],["\u003cp\u003ePredefined App Engine roles, such as Admin, Deployer, and Viewer, offer granular control, limiting access to App Engine-specific functionalities, and requiring additional roles for other services.\u003c/p\u003e\n"],["\u003cp\u003eThe App Engine Deployer role is recommended for accounts solely responsible for deploying new app versions, and it requires the Service Account User role for impersonating the default service account, as well as other roles for \u003ccode\u003egcloud\u003c/code\u003e commands usage.\u003c/p\u003e\n"],["\u003cp\u003eFor separating deployment tasks from traffic routing, the App Engine Deployer role and App Engine Service Admin role can be assigned to different job functions, with the Deployer managing new versions and the Admin controlling traffic routing and existing service configurations.\u003c/p\u003e\n"]]],[],null,["# Roles that Grant Access to App Engine\n\nRoles determine which services and actions are available to a user account or\nservice account. The following types of roles grant access to App Engine:\n\n- [Basic roles](#basic_roles) which apply to all services and resources in a\n project, including but not limited App Engine. For example, an account\n with the Editor role can change App Engine settings as well as Cloud\n Storage settings.\n\n- [Predefined App Engine roles](#predefined_roles), which provide\n granular access to App Engine. Each service in your\n Google Cloud project provides its own predefined roles. For example, an\n account that only has the App Engine Deployer role\n can deploy App Engine apps but cannot view or create objects\n in Cloud Storage. Such an account would also need a specific [Cloud Storage\n predefined role](/iam/docs/understanding-roles#cloud-storage-roles)\n to create or view objects in Cloud Storage.\n\n- [Custom roles](/iam/docs/understanding-custom-roles),\n which provide granular access according to a list of permissions you specify.\n\nYou can use basic roles when you are working on smaller projects that have\nless complex needs. For more fine-tuned access controls, use predefined roles.\n\nBasic roles\n-----------\n\nBasic roles apply to all services and resources in a project. For example, an\naccount in the Editor role can change App Engine settings as well as\nCloud Storage settings.\n\nPredefined App Engine roles\n---------------------------\n\nThe predefined roles for App Engine provide you with finer grained\noptions for access control.\n\n*These roles only provide access to App Engine.* If your project includes\nother services, such as Cloud Storage or Cloud SQL, you will need to assign\n[additional roles](/iam/docs/understanding-roles#predefined_roles) to enable access to the other services.\n\n### Comparison of App Engine predefined roles\n\nThe following table provides a complete comparison of the capabilities of each\npredefined App Engine role.\n\n| **Note:** The predefined roles are enforced in the [Google Cloud console](https://console.cloud.google.com/iam-admin/iam), the [Admin API](/appengine/docs/admin-api/access-control), and other tooling that requires access, including the [deployment commands](/appengine/docs/legacy/standard/python/tools/uploadinganapp).\n\nFor details about the specific IAM permissions that are granted by each role,\nsee the [Roles](/appengine/docs/admin-api/access-control#roles) section of the\nAdmin API.\n\nRecommended role for application deployment\n-------------------------------------------\n\nFor an account that is responsible *only* for deploying new versions of an app,\nwe recommend that you grant the following roles:\n\n- App Engine Deployer role (`roles/appengine.deployer`)\n- Service Account User role (`roles/iam.serviceAccountUser`)\n\n The [Service Account User role](/iam/docs/service-account-permissions#user-role)\n enables the account to impersonate the default App Engine service account\n during the deployment process.\n-\n If the account uses `gcloud` commands to deploy, add these roles as well:\n\n - Storage Object Admin (`roles/storage.objectAdmin`)\n - Cloud Build Editor (`roles/cloudbuild.builds.editor`)\n\n| **Note:** If you have granted an account the App Engine Admin role, you don't need to grant it the App Engine Deployer role, because the Admin role holds the same relevant permissions as the Deployer role, along with additional administrative privileges. We recommend using the App Engine Deployer role for accounts that are responsible only for deploying new versions.\n\nFor details about how to grant the required permissions, see\n[Creating a user account](/appengine/docs/legacy/standard/python/access-control#user_account).\n\n### Separation of deployment and traffic routing duties\n\nMany organizations prefer to separate the task of deploying an application\nversion from the task of ramping up traffic to the newly created version, and to\nhave these tasks done by different job functions. The App Engine Deployer and\nApp Engine Service Admin roles provide this separation:\n\n- App Engine Deployer plus Service Account User roles - Accounts are limited to deploying new versions and deleting old versions that are not serving traffic. The account with these roles won't be able to configure traffic to any version nor change application-level settings such as dispatch rules or authentication domain.\n- App Engine Service Admin role - Accounts cannot deploy a new version of an app nor change application-level settings. However, those accounts have privileges to change the properties of existing services and versions, including changing which versions can serve traffic. The App Engine Service Admin role is ideal for an Operations/IT department that handles ramping up traffic to newly deployed versions.\n\n\n| **Note** : Accounts with the App Engine Deployer role can overwrite a version that is serving traffic by deploying a new version with the same name (using the `--version` flag).\n\n\u003cbr /\u003e\n\n### Limitations of the predefined roles\n\nNone of the App Engine predefined roles grant access to the following:\n\n- View and download application logs.\n- View Monitoring charts in the Google Cloud console.\n- Enable and Disable billing.\n- Run security scans in Cloud Security Scanner.\n- Access configuration or data stored in Datastore, Task Queues, Cloud Search or any other Cloud Platform storage product."]]
