How to unactive IAP in google cloud project?

0
votes

I have a problem on a GCP Project

I Added IAP on the app. I allowed every user on the professional google domain.

I found that IAP was not a good solution. I finally removed IAP from the project. I un-toggled the functionality. And I removed the roles/members.

Now all the project crashes : Cloud Build return that error when I Tried to deploy my services by triggers "ERROR: (gcloud.app.deploy) PERMISSION_DENIED: You do not have permission to act as 'ID@appspot.gserviceaccount.com'" When I launch an http request to a service, the service doesn't create an instance. I have that error "Waiting for network connection open. Subject:"app/invalid" Address:127.0.0.1:8080"

The account "ID@appspot.gserviceaccount.com" has an owner role.

I already checked the IAM roles it not seems to have one missing, I've checked with other projects, it seems good.

It's not the code of the app cause I tried in my laptop in local and the services works perfectly. I've deployed my services with gcloud command, but the services are unreachable I have errors 500 cause my apps doesn't deploy.

I don't know which role I have to change in IAM to fix all the app.

1
google-app-enginegoogle-iap
The error message suggests that your Cloud Build service account doesn't have enough permissions to deploy to App Engine. Can you please check its permissions in Console-> Cloud Build-> Settings page and make sure that App Engine and Service Account User roles are enabled? – Emil Gi
Thank you for your very interesting answer. I saw in other of my project in CloudBuild params only App Engine Admin were enabled, for the same deployment using triggers. Why since IAP was added then removed the parameter Service Account User roles has to be enabled. – Tim
I finally fix my problem. Thank you very much for your answer. – Tim
All right i'll post it as an answer then. – Emil Gi
@Tim If Emil's answer fixed your issue, please mark it as accepted – Alex

1 Answers

1
votes

This error means that Cloud Build service account can't act on behalf of App Engine service account. You can add this permission in Console-> Cloud Build-> settings enabling service account user role. There should have been some change recently that enabled this requirement for App Engine deployments.