App Engine "appengine.applications.create ... not authorized" in CI

gcloud app deploy needs an App Engine application to exist in the project. If one was never created, the first deploy tries to create it, and the CI service account lacks appengine.applications.create, so the API rejects it.

What this error means

gcloud app deploy fails with "The caller does not have permission" or "the user is not authorized to perform this action" referencing appengine.applications.create.

ERROR: (gcloud.app.deploy) PERMISSION_DENIED: The caller does not have permission.
This may be because the user is not authorized to perform this action
(appengine.applications.create) on the project.

Common causes

No App Engine application exists yet

A project has at most one App Engine app. If it was never created, the deploy attempts creation, which needs elevated permission the CI account lacks.

The CI account lacks App Engine Admin

Creating the app and deploying versions requires roles/appengine.appAdmin (plus serviceAccountUser); a narrower role cannot create the application.

How to fix it

Create the application once with an admin identity

1. Run gcloud app create once with an account that has appengine.applications.create.
2. After the app exists, CI only needs to deploy versions, not create the app.
3. Re-run the CI deploy.

gcloud app create --project my-project --region us-central

Grant App Engine Admin to the CI account

Give the deploy account the roles it needs to manage versions and act as the runtime account.

gcloud projects add-iam-policy-binding my-project \
  --member="serviceAccount:ci@my-project.iam.gserviceaccount.com" \
  --role="roles/appengine.appAdmin"

How to prevent it

• Create the App Engine application as a one-time bootstrap, outside CI.
• Grant roles/appengine.appAdmin and roles/iam.serviceAccountUser to the deploy identity.
• Pin --project so the deploy targets the bootstrapped project.

Related guides