The App Engine Flexible Environment Service Account

In addition to the App Engine default service account, the App Engine flexible environment includes a Google-managed service account named App Engine flexible environment service account. The App Engine flexible environment service account enables your Cloud project to interact with the resources of your app separately from other Google Cloud services.

Google automatically creates this account when you deploy a project's first app to the App Engine flexible environment using App Engine tooling, such as the gcloud app deploy command.

The App Engine flexible environment service account is not listed on the Service Accounts page of the Cloud Console and has the following restrictions:

  • Do not revoke the roles that are granted to the App Engine flexible environment service account.
  • Do not grant the related App Engine Flexible Environment Service Agent role to any other account because the permissions that the role includes can change without notice.

Verifying the App Engine flexible environment service account

To verify that the App Engine flexible environment service account exists in your Cloud project, perform the following steps:

  1. Open the Cloud Console:

    Go to the Permissions page

  2. In the Members list, locate the ID of the App Engine flexible environment service account.

    The App Engine flexible environment service account uses the member ID
    service-[YOUR_PROJECT_NUMBER]@gae-api-prod.google.com.iam.gserviceaccount.com

  3. Verify that the App Engine flexible environment service account has been granted the App Engine Flexible Environment Service Agent role.

Service Agent role

The App Engine flexible environment service account has the App Engine Flexible Environment Service Agent role. The role includes a set of permissions needed by .NET flexible environment to manage your flexible environment apps. For example, this role includes permissions to perform the following tasks:

  • Deploying a new version.
  • Stopping or deleting existing versions.
  • Automatic weekly restarts and system updates.

The App Engine Flexible Environment Service Agent role is reserved for the App Engine flexible environment service account. Do not grant this IAM role to any other account, because the permissions that the role includes can change without notice.

Restoring a deleted service account

If you accidentally delete the App Engine flexible environment service account, you can restore it if was deleted within the last 30 days by following the steps in undeleting a service account.