26

I am trying to deploy node js app on google cloud but getting following error -

Step #1: ERROR: (gcloud.app.deploy) Permissions error fetching application [apps
/mytest-240512]. Please make sure you are using the correct project ID and that
you have permission to view applications on the project.

I am running following command - 

gcloud builds submit . --config cloudbuild.yaml

My cloudbuild.yaml file looks like - 

steps:
  #install
  - name: 'gcr.io/cloud-builders/npm'
    args: ['install']

   #deploy
  - name: 'gcr.io/cloud-builders/gcloud'
    args: ['app', 'deploy']
Sachin Vairagi
  • 4,894
  • 4
  • 35
  • 61

5 Answers5

55

The default Cloud Build service account does not allow access to deploy App Engine. You need to enable the Cloud Build service account to perform actions such as deploy.

The Cloud Build service account is formatted like this:

[PROJECT_NUMBER]@cloudbuild.gserviceaccount.com
  • Go to the Google Cloud Console -> IAM & admin -> IAM.
  • Locate the service account and click the pencil icon.
  • Add the role "App Engine Deployer" to the service account.

Wait a couple of minutes for the service account to update globally and then try again.

John Hanley
  • 74,467
  • 6
  • 95
  • 159
  • Thank you for your response John, I have to also enable - App engine API but now getting following message - Step #1: ERROR: (gcloud.app.deploy) Your deployment has succeeded, but promoting the new version to default failed. You may not have permissions to change traffic splits. Changing traffic splits requires the Owner, Editor, App Engine Admin, or App Engine Service Admin role. Please contact your project owner and use the `gcloud app services set-traffic --splits =1` command to redirect traffic to your newly deployed version. – Sachin Vairagi May 15 '19 at 04:29
  • 2
    working now, after adding "App Engine Admin" role to [PROJECT_NUMBER]@cloudbuild.gserviceaccount.com – Sachin Vairagi May 15 '19 at 04:29
  • 1
    I had assumed that you already had set up App Engine, which requires region selection, enabling services, etc. Now that you have an app deployed you should not need anything other than `gcloud app deploy` and `App Engine Deployer` permissions. It is OK to leave Cloud Build with App Engine Admin as that is a secure service controlled by Google. – John Hanley May 15 '19 at 04:42
  • is there any option in package.json to run command after build like heroku-postbuild – Sachin Vairagi May 15 '19 at 05:24
  • I am not sure. What are you trying to do? Note: I would create a new question for this to get a better chance of a good answer. – John Hanley May 15 '19 at 05:53
  • 1
    @SachinVairagi I found that the "Project Editor" plus "App Engine Deployer" permissions were sufficient to use Cloud Builder to deploy to GAE Standard Environment. – hamx0r Sep 15 '20 at 18:10
  • @hamx0r - Thank you for sharing your solution, it might help others. – Sachin Vairagi Sep 16 '20 at 05:25
6

I had this same error today and the way I resolve it was by running: $ gcloud auth login on the console.

This will open a new browser tab for you to login with the credentials that has access to the project you're trying to deploy.

I was able to deploy to gcloud after that.

ps.: I'm not sure this is the best approach, but I'm leaving this as a possible solution as this is how I usually go around this problem. Worst case, I'll stand corrected and learn something new.

rafaelbiten
  • 6,074
  • 2
  • 31
  • 36
2

Two commands can handle the perms needed (run in your terminal if you have gcloud sdk installed and authenticated or run in cloud shell for your project):

export PROJECT_ID=[[put your project id here]]
export PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format="value(projectNumber)")

gcloud iam service-accounts add-iam-policy-binding ${PROJECT_ID}@appspot.gserviceaccount.com \
--member=serviceAccount:${PROJECT_NUMBER}@cloudbuild.gserviceaccount.com \
--role=roles/iam.serviceAccountUser \
--project=${PROJECT_ID}
```
gcloud projects add-iam-policy-binding ${PROJECT_ID} \
--member=serviceAccount:${PROJECT_NUMBER}@cloudbuild.gserviceaccount.com \
--role=roles/appengine.appAdmin
Eric Lannert
  • 23
  • 3
2

You can also get this error if you forgot to enable billing on the project. I just had to go to the Google Cloud Console, search for App Engine and the billing setup popped up.

Arieck
  • 2,002
  • 2
  • 9
  • 8
0

In my case, the issue was that I have mistaken project ID for project NAME

starball
  • 20,030
  • 7
  • 43
  • 238
Bugs Bunny
  • 2,496
  • 1
  • 26
  • 32