gcloud app deploy Required 'compute.regions.get' permission for Owner Principal

Question

$ gcloud app deploy MY.yaml --image-url gcr.io/vorburger-learn-appengin/image:develop

causes the following error for me:

ERROR: (gcloud.app.deploy) PERMISSION_DENIED: Request to https://compute.googleapis.com/compute/v1/projects/projects/vorburger-learn-appengin/regions/europe-west1?key failed, details: Required 'compute.regions.get' permission for 'projects/vorburger-learn-appengin/regions/europe-west1'

I'm simply running gcloud locally after gcloud init for my @gmail.com account, who has the omnipotent IAM Owner role on that GCP project. So it's not clear to me just which IAM Principal is missing the compute.regions.get permission?

This is on a project where it used to work last year and stopped working 2 months ago. Maybe I deleted something by mistake? Things I've tried out so far:

• gcloud services enable appengineflex.googleapis.com mentioned here
• Verified @cloudservices.gserviceaccount.com Google APIs Service Agent exists and has the Editor role mentioned here
• I do NOT have any [email protected] account mentioned here on this project - should I?

Background: https://github.com/vorburger/www.fineract.dev/issues/15

Answer 1

I do NOT have any [email protected] account mentioned here on this project - should I?

Yes, you have to undelete the service account. However, the undelete command only works for Service Accounts deleted fewer than 30 days ago.

After 30 days, IAM permanently removes the service account. Google Cloud cannot recover the service account after it is permanently removed, even if you file a support request.

If you are not able to undelete the service account, you can create a new service account with the same name; revoke all of the roles from the deleted service account; and grant the same roles to the new service account. For details, see Policies with deleted principals.

Additionally, you did not mention the App Engine default service account if it was also accidentally deleted. If yes, you would also need to undelete this.

Warning: Deleting the App Engine default service account breaks any current and future App Engine applications in your Cloud project. For example, your application will lose access to other Google Cloud services such as Datastore. If needed, you can restore a deleted default service account.