App engine flexible environnement issues for Python Flask app

Question

I am actually annoyed about App Engine flexible environment deployment. I am using Cloud Build to deploy my code from a GitHub repository but this problem also occurs deploying manually.

I would like to create a simple Flask application with a flexible environment to load a Tensorflow model for a web application "analysis" part (it is not the better way to do that, GCP ML exists but I would like to use App Engine).

Here is my analysis.yaml file:

service: analysis
env: flex
runtime: custom

runtime_config:
  python_version: 3

resources:
  memory_gb: 2.4

(I also tried without entrypoint)

Deploying my service a Cloud Build a warning occurs as a following:

WARNING: Unable to verify that the Appengine Flexible API is enabled for project [XXX]. You may not have permission to list enabled services on this project. If it is not enabled, this may cause problems in running your deployment. Please ask the project owner to ensure that the Appengine Flexible API has been enabled and that this account has permission to list enabled APIs.

After asking this question I followed this post: How can I grant the account permission to list enabled APIs? , to enable App Engine API and to grant the right roles to my services account.

Using gcloud SDK I enabled and checked App Engine Flexible API with gcloud services enable appengineflex.googleapis.com and gcloud services list

Then, I granted the following roles to Cloud Build service account:

And those for my App Engine service account:

I do not really understand why my deployment failed. I suppose it triggers by a wrong permission role assignment but I do not know.

I look forward to your help and thanks in advance.

Answer 1

Please note that the default App Engine service account is different from App Engine flexible environment service account as explained in App Engine Official Documentation

The App Engine Flexible uses the member ID: service-[YOUR_PROJECT_NUMBER]@gae-api-prod.google.com.iam.gserviceaccount.com

Please verify that the App Engine flexible environment service account has been granted the App Engine Flexible Environment Service Agent role.

The App Engine Flexible Service Agent Role includes a set of permissions needed by Python flexible environment to manage your flexible environment apps.

Also please bear in mind that the App Engine Flexible Environment Service Agent role is reserved for the App Engine flexible environment service account . Do not grant this IAM role to any other account, because the permissions that the role includes can change without notice.