部署GAE应用时gcloud app deploy报错：创建Cloud Build失败，存储桶无效

创建新Google Cloud项目后，严格遵循官方《创建并部署新GAE应用》文档步骤操作，执行gcloud app deploy时出现权限错误，具体报错如下：

╔════════════════════════════════════════════════════════════╗
╠═ Uploading 12 files to Google Cloud Storage               ═╣
╚════════════════════════════════════════════════════════════╝
File upload done.
Updating service [default]...failed.
ERROR: (gcloud.app.deploy) Error Response: [13] Failed to create cloud build:
com.google.net.rpc3.client.RpcClientException: <eye3 title='/ArgoAdminNoCloudAudit.CreateBuild, FAILED_PRECONDITION'/>
APPLICATION_ERROR;google.devtools.cloudbuild.v1/ArgoAdminNoCloudAudit.CreateBuild;invalid bucket
"staging.<myproject-id-redacted>.appspot.com"; default Cloud Build service account or user-specified service account
does not have access to the bucket;AppErrorCode=9;StartTimeMs=1720838040970;unknown;ResFormat=uncompressed;ServerTimeSec=
1.2677860490000001;LogBytes=256;Non-FailFast;EndUserCredsRequested;EffSecLevel=none;ReqFormat=uncompressed;ReqID=
929904cf53cd5131;GlobalID=0;Server=[2002:a05:6220:101:b0:4:6180:ab19]:4001.

已排查过服务中断（当前无相关报告），尝试过启用额外API、给服务账号加权限等常见方案，均未解决问题。怀疑是服务故障或文档缺失，希望GCP团队跟进。

排查与修复步骤 #

1. 确认Cloud Build服务账号权限 #

• 找到项目的Cloud Build默认服务账号：[PROJECT_NUMBER]@cloudbuild.gserviceaccount.com
• 给该账号授予Storage Object Admin角色（针对staging.<PROJECT_ID>.appspot.com存储桶）
• 同时确保账号拥有Cloud Build Editor角色，避免构建权限不足

2. 检查存储桶的IAM配置 #

• 进入Cloud Storage控制台，找到staging.<PROJECT_ID>.appspot.com桶
• 确认上述Cloud Build服务账号已在IAM列表中，且权限包含：
  • storage.objects.create
  • storage.objects.get
  • storage.objects.list

3. 强制重新初始化存储桶权限 #

执行以下命令重置GAE相关存储桶的权限（需确保gcloud已授权）：

gcloud app repair --project=<PROJECT_ID>

4. 检查是否启用了必要API #

确保以下API已启用：

• Cloud Build API
• App Engine Admin API
• Cloud Storage API

5. 切换用户账号重试 #

如果使用的是项目所有者账号仍报错，尝试用服务账号密钥登录后部署：

gcloud auth activate-service-account --key-file=<SERVICE_ACCOUNT_KEY.json>
gcloud app deploy

内容的提问来源于stack exchange，提问作者myconode