Can you please clarify IAM Permissions Instructions?

Question

At https://support.atlassian.com/bitbucket-cloud/docs/deploy-to-google-cloud/

The instruction, "- An IAM user is configured with sufficient permissions to perform a deployment of your application using gcloud." is not helpful.

After much trial and error I found that the below permissions worked but I am not confident that all of them are required:

App Engine Admin

App Engine Deployer

Cloud Build Service Account

Service Account

UserStorage Object Admin

Halyna Berezovska · Answer

@Bruce Wilcox according to google docs https://cloud.google.com/iam/docs/understanding-roles?hl=en#app-engine-roles

you could try to remove first role and deploy.

It is said there that deployer has enough permissions to deploy, and this is a subset of app engine admin role, while admin can also modify access to application settings. If you don't need them , you can remove app engine admin role and this should work.

BUT also pay attention that you can see in the deployer role description the following:

```

Note: This role includes the required permissions to deploy using the App Engine Admin API. To use other App Engine tooling, such as the gcloud command-line tool, you must also have the Compute Storage Admin (roles/compute.storageAdmin) and Cloud Build Editor (roles/cloudbuild.builds.editor) roles.

```

So if without admin it fails, try to add roles : compute storage admin , cloud build editor