Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Depois de criar um aplicativo do App Engine, a
conta de serviço padrão do App Engine
é criada e usada como a identidade do
aplicativo do App Engine. A conta de serviço padrão do App Engine é
associada ao projeto Google Cloud e executa tarefas em nome dos
aplicativos em execução no App Engine.
Como visualizar a conta de serviço padrão do App Engine
Para ver as contas de serviço:
No console Google Cloud , acesse a página Contas de serviço.
Se você desativar a concessão automática de papéis, precisará decidir quais papéis conceder às contas de serviço
padrão e, em seguida, conceder esses papéis
por conta própria.
Se a conta de serviço padrão já tiver o papel de Editor, recomendamos que você o substitua
por papéis menos permissivos.Para modificar com segurança os papéis da conta de serviço, use o Simulador de política para conferir o impacto da
mudança e, em seguida, conceda e revogue os
papéis apropriados.
Como alterar as permissões da conta de serviço
É possível usar o console Google Cloud para conceder ou remover papéis da
conta de serviço padrão. Por exemplo, reduzir as permissões usadas pela conta de serviço padrão do App Engine alterando o papel de Editor para qualquer papel que atenda melhor às necessidades de acesso do aplicativo do App Engine.
Para modificar papéis da conta de serviço padrão do App Engine:
Localize a conta de serviço padrão do App Engine na lista de principais. A conta de serviço padrão do App Engine aparecerá na lista se os papéis tiverem sido concedidos automática ou manualmente à conta de serviço.
Selecione o botão de edição para modificar os papéis atribuídos à conta de serviço.
Como restaurar uma conta de serviço padrão excluída
Se você excluir a conta de serviço padrão do App Engine, seu
aplicativo do App Engine poderá ser interrompido e perder o acesso a outros
serviçosGoogle Cloud , como o Datastore.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-11 UTC."],[[["\u003cp\u003eThe App Engine default service account is automatically created when you create an App Engine application and is used as the identity for your app.\u003c/p\u003e\n"],["\u003cp\u003eYou can view the App Engine default service account's email address in the Google Cloud console's Service Accounts page, which follows the format \u003ccode\u003eYOUR_PROJECT_ID@appspot.gserviceaccount.com\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eIt's highly recommended to disable the automatic grant of the Editor role to the default service account, which can be done by enforcing the \u003ccode\u003eiam.automaticIamGrantsForDefaultServiceAccounts\u003c/code\u003e organization policy constraint, and instead manually grant necessary roles.\u003c/p\u003e\n"],["\u003cp\u003eDeleting the App Engine default service account will cause your App Engine application to break and lose access to other Google Cloud services, but it can be restored if deleted within the last 30 days.\u003c/p\u003e\n"],["\u003cp\u003eYou can modify the roles assigned to the App Engine default service account, such as downgrading from Editor to more specific roles, via the IAM page in the Google Cloud console.\u003c/p\u003e\n"]]],[],null,["# Using the Default App Engine Service Account\n\nAfter you create an App Engine application, the\n*[App Engine default service account](/iam/docs/service-account-types#default)*\nis created and used as the identity of your\nApp Engine app. The App Engine default service account is\nassociated with your Google Cloud project and executes tasks on behalf of your\napps running in App Engine.\n\nViewing the App Engine default service account\n----------------------------------------------\n\nTo view your service accounts:\n\n1. In the Google Cloud console, go to the **Service accounts** page.\n\n [Go to Service accounts](https://console.cloud.google.com/iam-admin/serviceaccounts)\n2. Select your project.\n\n3. In the list, locate the email address of the App Engine default service account: \n\n\n \u003cvar translate=\"no\"\u003eYOUR_PROJECT_ID\u003c/var\u003e`@appspot.gserviceaccount.com`\n\nModifying the default service account\n-------------------------------------\n\n\nDepending on your organization policy configuration, the default service account might\nautomatically be granted the [Editor role](/iam/docs/roles-overview#basic) on your\nproject. We strongly recommend that you disable the automatic role grant by [enforcing the `iam.automaticIamGrantsForDefaultServiceAccounts` organization policy\nconstraint](/resource-manager/docs/organization-policy/restricting-service-accounts#disable_service_account_default_grants). If you created your organization after May 3, 2024, this\nconstraint is enforced by default.\n\n\nIf you disable the automatic role grant, you must decide which roles to grant to the default\nservice accounts, and then [grant these\nroles](/iam/docs/granting-changing-revoking-access) yourself.\n\n\nIf the default service account already has the Editor role, we recommend that you replace the\nEditor role with less permissive roles.To safely modify the service account's roles, use [Policy Simulator](/policy-intelligence/docs/simulate-iam-policies) to see the impact of\nthe change, and then [grant and revoke the\nappropriate roles](/iam/docs/granting-changing-revoking-access).\n\n\u003cbr /\u003e\n\n| **Warning:** Deleting the App Engine default service account breaks any current and future App Engine applications in your Google Cloud project. For example, your application will lose access to other Google Cloud services such as Datastore. If needed, you can [restore a deleted default\n| service account](#repair-service-account).\n\n### Changing service account permissions\n\nYou can use the Google Cloud console to grant or remove roles from the\ndefault service account. For example, you can\ndowngrade the permissions used by the App Engine default service account\nby changing its role from Editor to whichever role(s) that best represent the\naccess needs for your App Engine app.\n\nTo modify roles for the App Engine default service account:\n\n1. In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/iam-admin/iam)\n2. Select your project.\n\n3. Locate the App Engine default service account in the\n Principals list. The App Engine default service account appears in\n the list if roles have been automatically or manually granted to the\n service account.\n\n4. Select the edit button to modify the roles assigned to the service account.\n\n| **Note:** You cannot remove application access to its task queues and cron jobs.\n\nUsing the default service account\n---------------------------------\n\nYour App Engine app uses the credentials of the App Engine\nservice account by default. For more information, see [Granting your app access\nto Cloud services](/appengine/docs/legacy/standard/python/access-control\n\n#apps).\n\nRestoring a deleted default service account\n-------------------------------------------\n\nIf you delete your App Engine default service account, your\nApp Engine application might break and lose access to other\nGoogle Cloud services, such as Datastore.\n\nYou can restore App Engine default service accounts that have been deleted\nwithin the last 30 days by following the steps in\n[undeleting a service account](/iam/docs/service-accounts-delete-undelete#undeleting).\n\nMore information about service accounts\n---------------------------------------\n\n- [Default service accounts](/iam/docs/service-account-types#default)\n\n- [Managing service accounts](/iam/docs/creating-managing-service-accounts)"]]
