Agente de servicio del entorno estándar de App Engine
Organiza tus páginas con colecciones
Guarda y categoriza el contenido según tus preferencias.
Además de la cuenta de servicio predeterminada
de App Engine, el
entorno estándar de App Engine incluye un agente de servicio del entorno estándar de App Engine. El agente de servicio
permite que el proyecto de Google Cloud interactúe con los recursos de la app
por separado desde otros servicios de Google Cloud.
Google crea esta cuenta de forma automática cuando implementas la primera app de un proyecto en el entorno estándar de App Engine con las herramientas de App Engine, como el comando gcloud app deploy.
El agente de servicio no aparece en la página Cuentas de servicio de la consola de Google Cloud y tiene las siguientes restricciones:
No revoca las funciones otorgadas al agente de servicio.
En la esquina superior derecha de la página Permisos, selecciona la casilla de verificación Incluir asignaciones de funciones proporcionadas por Google.
En la lista Principales, ubica el ID del agente de servicios del entorno estándar de App Engine, que usa el ID service-PROJECT_NUMBER@gcp-gae-service.iam.gserviceaccount.com.
Verifica que el agente de servicio tenga el rol de agente de servicio del entorno estándar de App Engine.
Función de agente de servicio
El agente de servicio tiene el rol de Agente de servicio del entorno estándar de App Engine.
El rol incluye un conjunto de permisos que el entorno estándar de PHP 5 necesita para administrar tus apps de entorno estándar. Por ejemplo, esta función incluye permisos para realizar estas tareas:
Obtén un token de acceso para que las instancias de App Engine accedan a otros recursos de Google Cloud, como un bucket de Cloud Storage.
Usa la API de Blobstore de los servicios en paquetes heredados de App Engine.
El rol de agente de servicio del entorno estándar de App Engine está reservada para el agente de servicio. No otorgues esta función de IAM a ninguna otra cuenta, ya que los permisos que incluye la función pueden cambiar sin previo aviso.
Restablece un agente de servicio borrado
Si borras el agente de servicio del entorno estándar de App Engine por accidente, sigue estos pasos para restablecerlo:
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2024-12-22 (UTC)"],[[["\u003cp\u003eThe App Engine standard environment includes a service agent that enables your Google Cloud project to interact with your app's resources separately from other Google Cloud services.\u003c/p\u003e\n"],["\u003cp\u003eThis service agent is automatically created when you deploy a project's first app to the App Engine standard environment and is not listed on the Service Accounts page.\u003c/p\u003e\n"],["\u003cp\u003eIt's crucial not to revoke the roles granted to the service agent or grant its specific role to any other account, as this can impact app deployment.\u003c/p\u003e\n"],["\u003cp\u003eYou can verify the existence and role of the service agent by checking the Permissions page in the Google Cloud console and locating the service agent ID, which is \u003ccode\u003eservice-PROJECT_NUMBER@gcp-gae-service.iam.gserviceaccount.com\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eIf the service agent is accidentally deleted, you can restore it by adding a new principal with the service agent's ID and assigning it the "App Engine standard environment Service Agent" role in the Permissions page.\u003c/p\u003e\n"]]],[],null,["# The App Engine standard environment service agent\n\nIn addition to the [App Engine default service\naccount](/appengine/docs/legacy/standard/php/service-account), the\nApp Engine standard environment includes a *App Engine standard environment service agent*. The service agent\nenables your Google Cloud project to interact with the resources of your app\nseparately from other Google Cloud services.\n\nGoogle automatically creates this account when you deploy a project's first app\nto the App Engine standard environment using App Engine tooling,\nsuch as the `gcloud app deploy` command.\n\nThe service agent is not listed on the Service\nAccounts page of the Google Cloud console and has the following restrictions:\n\n- Do not revoke the roles that are granted to the service agent.\n- Do not grant the related [App Engine standard environment service agent\n role](#service_agent_role) to any other account because the permissions that the role includes can change without notice.\n\n| **Warning:** Removing the service agent removes the binding for the service agent from your Google Cloud project. If you remove the binding or change the permissions for the service agent, any deployment to your app in the standard environment might fail.\n\nVerifying the App Engine standard environment service agent\n-----------------------------------------------------------\n\nTo verify that the service agent exists\nin your Google Cloud project, perform the following steps:\n\n1. Open the Google Cloud console:\n\n [Go to the Permissions\n page](https://console.cloud.google.com/iam-admin/iam)\n2. In the upper-right corner of the **Permissions** page, select the\n **Include Google-provided role grants** checkbox.\n\n3. In the **Principals** list, locate the ID of the App Engine standard environment service\n agent, which uses the ID \n\n `service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcp-gae-service.iam.gserviceaccount.com`.\n\n4. Verify that the service agent has been\n granted the **App Engine standard environment Service Agent** role.\n\nService Agent role\n------------------\n\nThe service agent has the\n[App Engine standard environment Service Agent role](/iam/docs/understanding-roles#appengine.serviceAgent).\nThe role includes a set of permissions needed by PHP 5 standard environment to\nmanage your standard environment apps. For example,\nthis role includes permissions to perform the following tasks:\n\n- Get an access token for App Engine instances to access other Google Cloud resources, such as a Cloud Storage bucket.\n- Use the [Blobstore API](/appengine/docs/legacy/standard/php/blobstore) from App Engine legacy bundled services.\n\nThe App Engine standard environment Service Agent role is reserved for the\nservice agent. Do not grant this\n[IAM role](/iam/docs/overview#roles) to any other account, because the\npermissions that the role includes can change without notice.\n\nRestoring a deleted service agent\n---------------------------------\n\nIf you accidentally delete the App Engine standard environment service agent,\nrestore it by performing the following steps:\n\n1. Open the Google Cloud console:\n\n [Go to the Permissions\n page](https://console.cloud.google.com/iam-admin/iam)\n2. Click **Add**.\n\n3. Enter the service agent ID using the format \n\n `service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcp-gae-service.iam.gserviceaccount.com`.\n\n4. Select the **App Engine standard environment Service Agent** role.\n\n5. Click **Save**."]]
