Warning: Currently, there is a
known issue where your
project may be billed for
agent.googleapis.com-prefixed metrics if you assign
a user-managed service account to an App Engine flexible environment version. Normally, these
agent metrics are not charged to your project. We recommend that you continue
to use the App Engine default service account until this issue is
App Engine apps require a service account in order to access other Google Cloud services and execute tasks. By default, the App Engine default service account is used as the identity of your App Engine app. You may also specify a user-managed service account to be used as the identity for a specific version of your App Engine app. This allows you to grant different privileges to each version, based on the specific tasks it performs, and avoid granting more privileges than necessary.
This guide covers how to specify a user-managed service account when deploying a new version. If you don't need to create a distinct service account when deploying a specific version of your app, you can continue to use the default service account by not specifying a service account.
Creating a user-managed service account
To create a user-managed service account, see these instructions. When defining the Identity and Access Management (IAM) roles to grant your service account, you can refer to Roles that Grant Access to Access to App Engine.
Specifying a service account when deploying your app
gcloud beta app deploy command and specify your service account:
gcloud app deploy --service-account=SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com