ERROR: (gcloud.app.deploy) You do not have permission to access app [my-app] (or it may not exist): The caller does not have permission

Question

I am trying to deploy my Google App Engine app through Bitbucket Pipelines. However I'm getting the following permission error while trying to deploy.

This is my bitbucket-pipelines.yml script:

script:
          # Install Google App Engine SDK
          - curl -o /tmp/google-cloud-sdk.tar.gz https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-155.0.0-linux-x86_64.tar.gz
          - tar -xvf /tmp/google-cloud-sdk.tar.gz -C /tmp/
          - /tmp/google-cloud-sdk/install.sh -q
          - source /tmp/google-cloud-sdk/path.bash.inc
          # Authenticating with the service account key file
          - echo $GOOGLE_CLIENT_SECRET > ./gcloud-api-key.json
          - gcloud auth activate-service-account --key-file gcloud-api-key.json
          # Linking to the Google Cloud project
          - gcloud config list
          - gcloud config set project $CLOUDSDK_CORE_PROJECT          
          - gcloud app deploy --log-http --verbosity=debug app.yaml

Please find the debug log below.

DEBUG: API endpoint: [https://appengine.googleapis.com/], API version: [v1]
=======================
==== request start ====
uri: https://appengine.googleapis.com/v1/apps/my-app?alt=json
method: GET
== headers start ==
Authorization: Bearer [hidden]
accept: application/json
accept-encoding: gzip, deflate
content-length: 0
user-agent: google-cloud-sdk x_Tw5K8nnjoRAqULM9PFAC2b gcloud/155.0.0 command/gcloud.app.deploy invocation-id/234e7fc5072e448aaa6870de17b900f2 environment/None environment-version/None interactive/False python/2.7.13 (Linux 4.19.43-coreos)
== headers end ==
== body start ==
== body end ==
==== request end ====

---- response start ----
-- headers start --
-content-encoding: gzip
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: private
content-length: 126
content-type: application/json; charset=UTF-8
date: Sun, 09 Jun 2019 22:39:11 GMT
server: ESF
status: 403
transfer-encoding: chunked
vary: Origin, X-Origin, Referer
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0
-- headers end --
-- body start --
{
  "error": {
    "code": 403,
    "message": "The caller does not have permission",
    "status": "PERMISSION_DENIED"
  }
}
-- body end --
total round trip time (request+response): 0.389 secs
---- response end ----
----------------------
DEBUG: HttpError accessing <https://appengine.googleapis.com/v1/apps/my-app?alt=json>: response: <{'status': '403', 'content-length': '126', 'x-xss-protection': '0', 'x-content-type-options': 'nosniff', 'transfer-encoding': 'chunked', 'vary': 'Origin, X-Origin, Referer', 'server': 'ESF', '-content-encoding': 'gzip', 'cache-control': 'private', 'date': 'Sun, 09 Jun 2019 22:39:11 GMT', 'x-frame-options': 'SAMEORIGIN', 'alt-svc': 'quic=":443"; ma=2592000; v="46,44,43,39"', 'content-type': 'application/json; charset=UTF-8'}>, content <{
  "error": {
    "code": 403,
    "message": "The caller does not have permission",
    "status": "PERMISSION_DENIED"
  }
}
>
DEBUG: (gcloud.app.deploy) You do not have permission to access app [my-app] (or it may not exist): The caller does not have permission
Traceback (most recent call last):
  File "/tmp/google-cloud-sdk/lib/googlecloudsdk/calliope/cli.py", line 712, in Execute
    resources = args.calliope_command.Run(cli=self, args=args)
  File "/tmp/google-cloud-sdk/lib/googlecloudsdk/calliope/backend.py", line 784, in Run
    resources = command_instance.Run(args)
  File "/tmp/google-cloud-sdk/lib/surface/app/deploy.py", line 61, in Run
    args, runtime_builder_strategy=runtime_builder_strategy)
  File "/tmp/google-cloud-sdk/lib/googlecloudsdk/command_lib/app/deploy_util.py", line 369, in RunDeploy
    app = _PossiblyCreateApp(api_client, project)
  File "/tmp/google-cloud-sdk/lib/googlecloudsdk/command_lib/app/deploy_util.py", line 499, in _PossiblyCreateApp
    return api_client.GetApplication()
  File "/tmp/google-cloud-sdk/lib/googlecloudsdk/api_lib/app/appengine_api_client.py", line 48, in GetApplication
    return requests.MakeRequest(self.client.apps.Get, request)
  File "/tmp/google-cloud-sdk/lib/googlecloudsdk/api_lib/app/api/requests.py", line 85, in MakeRequest
    raise api_lib_exceptions.HttpException(error, error_message=error_message)
HttpException: You do not have permission to access app [my-app] (or it may not exist): The caller does not have permission
ERROR: (gcloud.app.deploy) You do not have permission to access app [my-app] (or it may not exist): The caller does not have permission

I already set a large list of permission to my service account and I keep getting the same error:

• App Engine Admin
• App Engine Deployer
• App Engine Service Admin
• App Engine flexible environment Service Agent
• Browser
• Cloud Build Editor
• Cloud Build Service Agent
• Environment and Storage Object Administrator
• Compute Admin
• Compute Instance Admin (v1)
• Compute Storage Admin
• Service Account Admin
• Storage Admin
• Storage Object Admin Viewer

Answer 1

I found this post. Deploy to Google Cloud with bitbucket pipeline

First, you’ll need to create a Google service account key. For more guidance see Google's guide to creating service keys.

1. open up your terminal
2. browse to the location of your key file
3. encode your file in base64 format: base64 -w 0 Note: for some versions of MacOS the -w 0 is not necessary.
4. copy the output of the command
5. go to your repository settings in Bitbucket and then Pipelines > Repository variables
6. create a new variable named KEY_FILE and paste the encoded service account credentials.

bitbucket-pipelines.yml

image: node:10.15.1
    pipelines:
      default:
        - step:
            name: Build and Test
            script:
              - npm install
              - npm test
        - step:
            name: Deploy
            script:
              - pipe: atlassian/google-app-engine-deploy:0.2.1
                variables:
                  KEY_FILE: $KEY_FILE
                  PROJECT: 'my-project'