google-app-engine - 收到 403 错误，但正在部署版本，流量为 0%

Question

我在 JDK 8 中使用 maven 插件 1.9.60

运行命令

mvn install appengine:update -Dappengine.additionalParams="--service_account_json_key_file=client-secret.json"

我可以看到已部署的版本，但流量为 0%。日志显示错误如下。有人可以建议如何解决这个问题吗？

Beginning interaction for module default...
0% Created staging directory at: '/var/folders/ny/z92xw4ps0j71v43mnvjzjyd80000gn/T/appcfg7082099622802800350.tmp'
5% Scanning for jsp files.
8% Generated git repository information file.
20% Scanning files on local disk.
25% Initiating update.
28% Cloning 34 application files.
40% Uploading 2 files.
52% Uploaded 1 files.
61% Uploaded 2 files.
68% Sending batch containing 2 file(s) totaling 1KB.
73% Initializing precompilation...
90% Deploying new version.
95% Closing update: new version is ready to start serving.
98% Uploading index definitions.
Feb. 19, 2018 12:54:48 AM com.google.appengine.tools.admin.AbstractServerConnection send1
WARNING: Error posting to URL: https://appengine.google.com/api/datastore/index/add?app_id=clean-aleph-191303&version=beta-001&
403 Forbidden
You do not have permission to modify this app (app_id=u'f~clean-aleph-191303').
This is try #0
Feb. 19, 2018 12:54:48 AM com.google.appengine.tools.admin.AbstractServerConnection send1
WARNING: Error posting to URL: https://appengine.google.com/api/datastore/index/add?app_id=clean-aleph-191303&version=beta-001&
403 Forbidden
You do not have permission to modify this app (app_id=u'f~clean-aleph-191303').
This is try #1
Feb. 19, 2018 12:54:49 AM com.google.appengine.tools.admin.AbstractServerConnection send1
WARNING: Error posting to URL: https://appengine.google.com/api/datastore/index/add?app_id=clean-aleph-191303&version=beta-001&
403 Forbidden
You do not have permission to modify this app (app_id=u'f~clean-aleph-191303').
This is try #2
Feb. 19, 2018 12:54:49 AM com.google.appengine.tools.admin.AbstractServerConnection send1
WARNING: Error posting to URL: https://appengine.google.com/api/datastore/index/add?app_id=clean-aleph-191303&version=beta-001&
403 Forbidden
You do not have permission to modify this app (app_id=u'f~clean-aleph-191303').
This is try #3

Error Details:
2018-02-19 00:54:17.700:INFO::main: Logging initialized @409ms
2018-02-19 00:54:17.816:INFO:oejs.Server:main: jetty-9.3.18.v20170406
2018-02-19 00:54:19.481:INFO:oeja.AnnotationConfiguration:main: Scanning elapsed time=1228ms
2018-02-19 00:54:19.497:INFO:oejq.QuickStartDescriptorGenerator:main: Quickstart generating
2018-02-19 00:54:19.512:INFO:oejsh.ContextHandler:main: Started o.e.j.q.QuickStartWebApp@2aceadd4{/,file:///private/var/folders/ny/z92xw4ps0j71v43mnvjzjyd80000gn/T/appcfg7082099622802800350.tmp/,AVAILABLE}
2018-02-19 00:54:19.514:INFO:oejs.Server:main: Started @2231ms
2018-02-19 00:54:19.517:INFO:oejsh.ContextHandler:main: Stopped o.e.j.q.QuickStartWebApp@2aceadd4{/,file:///private/var/folders/ny/z92xw4ps0j71v43mnvjzjyd80000gn/T/appcfg7082099622802800350.tmp/,UNAVAILABLE}


com.google.appengine.tools.admin.HttpIoException: Error posting to URL: https://appengine.google.com/api/datastore/index/add?app_id=clean-aleph-191303&version=beta-001&
403 Forbidden
You do not have permission to modify this app (app_id=u'f~clean-aleph-191303').

Unable to update app: Error posting to URL: https://appengine.google.com/api/datastore/index/add?app_id=clean-aleph-191303&version=beta-001&
403 Forbidden
You do not have permission to modify this app (app_id=u'f~clean-aleph-191303').

appengine-web.xml```

<?xml version="1.0" encoding="utf-8"?>
<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
  <application>clean-aleph-191303</application>
  <version>beta-001</version>
  <threadsafe>true</threadsafe>
  <runtime>java8</runtime>
</appengine-web-app>

```

pom.xml(插件声明)```

<plugin>
    <groupId>com.google.appengine</groupId>
    <artifactId>appengine-maven-plugin</artifactId>
    <version>1.9.60</version>
</plugin>

```

可以在此处找到完整的 bitbucket 存储库。

https://bitbucket.org/rohgoyal/springbootgcp-example/src

Answer 1

您遇到的问题是由于服务帐户缺少角色。它可能分配了“App Engine Deployer”角色，但缺少“Datastore Index Admin”角色，这会导致在 POST 到 appengine.google.com/api/datastore/index/时出现 403

添加该角色后，您需要重新生成私钥(如您所命名的 client-secret.json)，因为旧私钥将没有新权限。

有关部署 GAE 应用程序所需的角色的更多信息，请访问 Deploying using IAM roles。部分。

注意:感谢您提供完整的重现。它总是很有帮助。