The roles you've specified (*Project Editor* and *App Engine Admin*) should be sufficient to allow a given account to deploy an App Engine application to your project. The Access Control article <https://cloud.google.com/appengine/docs/java/access-control#predefined_roles_comparison_matrix> shows a helpful matrix of App Engine roles and the abilities they grant. You may also want to consider *App Engine Deployer* for even more restrictive permissions allowing deployment only, no management of config (dispatch, cron, etc) changes depending on the roles the user plays.
As for the *403* encountered by said user, it may be that the member that you added to the project is not the credential used by that user with they ran *gcloud auth login <https://cloud.google.com/sdk/gcloud/reference/auth/login>*. They can use *gcloud info <https://cloud.google.com/sdk/gcloud/reference/info>* to see what account the gcloud commands are being invoked from. If they are logged authenticated with gcloud using *use...@your-domain.com* and *use...@your-domain.com* has both *Project Editor* and *App Engine Admin* roles associated with it, I'd recommend filing a new issue with on the Google Cloud Platform public issue tracker <https://code.google.com/p/google-cloud-platform/issues/list>. If doing so, be sure to include a link to it here. This way, I can make the issue private so you can safely provide the project ID, timestamps and username in question so that we can investigate this more thoroughly. On Monday, February 13, 2017 at 11:24:56 AM UTC-5, Dave Chen wrote: > > Simple question: I'm trying to setup a new project with a user to > administer and deploy AppEngine applications. Ideally the user will have as > limited an IAM role as possible. My first try is to give the user > - Project Editor > - AppEngine.admin > > But when running ``gcloud app create`` the return is "insufficient > permissions". I've not been able to find this described in the > documentation--can someone please lend a hand? > Thanks! > -dave > > -- You received this message because you are subscribed to the Google Groups "Google App Engine" group. To unsubscribe from this group and stop receiving emails from it, send an email to google-appengine+unsubscr...@googlegroups.com. To post to this group, send email to google-appengine@googlegroups.com. Visit this group at https://groups.google.com/group/google-appengine. To view this discussion on the web visit https://groups.google.com/d/msgid/google-appengine/3e228218-83d6-4c84-8a65-d87ee231e124%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
