App Engine apps require a service account in order to access other Google Cloud services and execute tasks. By default, the App Engine default service account is used as the identity of your App Engine app. You may also specify a user-managed service account to be used as the identity for a specific version of your App Engine app. This allows you to grant different privileges to each version, based on the specific tasks it performs, and avoid granting more privileges than necessary.
This guide covers how to specify a user-managed service account when deploying a new version. If you don't need to create a distinct service account when deploying a specific version of your app, you can continue to use the default service account by not specifying a service account.
Creating a user-managed service account
To create a user-managed service account, see these instructions. When defining the Identity and Access Management (IAM) roles to grant your service account, you can refer to Roles that Grant Access to Access to App Engine.
Specifying a service account when deploying your app
gcloud beta app deploy command and specify your service account:
gcloud app deploy --service-account=SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com