Appengine gcloud 部署使用自定义服务帐户

Question

我想将 API 部署到 App Engine 但它最终使用了错误的服务帐户。 我在 gitlab 中使用了这 3 行 cmd：

 - gcloud auth activate-service-account --key-file /tmp/$CI_PIPELINE_ID.json
 - gcloud config set account NameOfServiceAccount.com
 - gcloud app deploy

我得到的是

target service account:      [App Engine default service account]
Do you want to continue (Y/n)?  
Beginning deployment of service [lettering-back]...
╔════════════════════════════════════════════════════════════╗
╠═ Uploading 2 files to Google Cloud Storage                ═╣
╚════════════════════════════════════════════════════════════╝
File upload done.
ERROR: (gcloud.app.deploy) PERMISSION_DENIED: You do not have permission to act as

Answer 1

要部署新版本，成员必须在 App Engine 默认服务帐户上具有服务帐户用户 (roles/iam.serviceAccountUser) 角色，以及 Cloud Build Editor (roles/cloudbuild.builds.editor) 和 Cloud Storage Object Admin（角色/storage.objectAdmin) 项目上的角色。

更具体地说，对于您的错误消息，您需要在您的服务帐户上使用roles/iam.serviceAccountUser ，其密钥是您放置在/tmp/$CI_PIPELINE_ID.json的密钥

参考：第一表行在https://cloud.google.com/appengine/docs/standard/python/roles#predefined_roles