Can't deploy app to App Engine, it fails with `Unable to write to staging bucket` and `unable to resolve resource`

Question

I'm using the gcloud SDK to try to deploy a Dockerfile and app.yaml to app engine. My App Engine service account has Project Editor and Storage Admin and SQL Client roles, and the Cloud Build, App Engine, and App Engine Flexible APIs are all enabled. Nonetheless, I keep encountering this error with gcloud beta:

    ERROR: (gcloud.beta.app.deploy) Error Response: [7] Unable to write to staging bucket staging. 
   <project name>.appspot.com. Please grant access to the App Engine service account on your project 
   by visiting https://console.developers.google.com/storage/browser?project=<project name>

and this (less clear) error with vanilla gcloud:

ERROR: (gcloud.app.deploy) INVALID_ARGUMENT: unable to resolve source

In a different sandbox/dev project, I didn't have this issue, but in this production project, that hasn't been the case. Adding the SAs manually makes no difference. And weirdly, the deploy is writing the files to the staging bucket, so I don't trust this error. Where it seems to be failing is the step immediately after that--maybe App Engine Flexible service account agent wants to access them; maybe the Dockerfile needs to be passed onward to Cloud Build SA; but in any case, I have tried every combination of granting bucket access to both App Engine and Cloud Build SAs and their agents as well, and it hasn't worked.

My user account has app engine deployer role assigned to it, and even impersonating the App Engine account with its editor role didn't make a difference. Cloud Build has App Deployer role as well.

One of the things I noticed on the error message is that you are using gcloud beta app deploy, why not use gcloud app deploy? This could be part of the issue. — Rafael Lemos
No, I've tried both, and the error is less clear. I'll add it for clarity though. — Chris Ivan

Rafael Lemos Rafael Lemos · Accepted Answer · 2020-06-03T13:57:55

The error of the Vanilla GCloud indicates that your service account is likely missing some permissions. Try disabling and re-enabling the Cloud Build API in your project so a new service account is created.

This ensures that Cloud Build has permission to start builds.

Also, make sure to wait a few minutes before trying to deploy (like 10 minutes or so), so that the permissions can be propagated to all systems.

Can't deploy app to App Engine, it fails with `Unable to write to staging bucket` and `unable to resolve resource`

1 Answers