Unable to give Google App Engine Service Account access to Google Cloud Storage

Question

I am a user of Google App Engine (GAE). In GAE there's an option we can backup the datastore to a Google Cloud Storage (GCS) Bucket. I have signed up GCS, enabled billing and created a Bucket successfully. However, when I try the backup function in GAE Console - Datastore admin, it gives me an error message like this:

Start Backup Job Status There was a problem kicking some off the jobs/tasks: Bucket "myappxxxxxx-cloud-storage" is not accessible End

I did some research online and found we need to add the GAE's Service Account as a team member of the GCS, I have done so, however, as I "Invite a user to collaborate on this application" and enter the server account email address which is like mygaexxxxx@appspot.gserviceaccount.com, I got no email because this is not supposed to be a real email account, I received no invitation and the Status is always in pending state

So what can I do now?

Answer 1

Another indirect way on solving this problem is to write your own mail handler in GAE. then you can receive email sent to your GAE email address.

Answer 2

You can give the service account (and therefore your application) access to all of the Google services in one shot by adding it to the team in the API Console.

As you point out, your can also do it using gsutil setacl/getacl commands as well. In this case, you're giving access to a specific bucket rather than all buckets in a Project.

Answer 3

An alternative solution is to use the gsutil command line approach to edit the Access Control List (ACL) as described in https://developers.google.com/appengine/docs/python/googlestorage/overview

By doing this there is no need for email invitation and the account does not show up in the console