After you create an App Engine application, theApp Engine default service accountis created and used as the identity of yourApp Engine app. The App Engine default service account isassociated with your Google Cloud project and executes tasks on behalf of yourapps running in App Engine.

Viewing the App Engine default service account

To view your service accounts:

1. In the Google Cloud console, go to theService accounts page.

   Go to Service accounts

2. Select your project.

3. In the list, locate the email address of the App Engine default service account:
   
   YOUR_PROJECT_ID@appspot.gserviceaccount.com

Modifying the default service account

Depending on your organization policy configuration, the default service account might automatically be granted theEditor role on your project. We strongly recommend that you disable the automatic role grant by enforcing theiam.automaticIamGrantsForDefaultServiceAccounts organization policy constraint. If you created your organization after May 3, 2024, this constraint is enforced by default.

If you disable the automatic role grant, you must decide which roles to grant to the default service accounts, and thengrant these roles yourself.

If the default service account already has the Editor role, we recommend that you replace the Editor role with less permissive roles.To safely modify the service account's roles, usePolicy Simulator to see the impact of the change, and thengrant and revoke the appropriate roles.

Changing service account permissions

You can use the Google Cloud console to grant or remove roles from thedefault service account. For example, you candowngrade the permissions used by the App Engine default service accountby changing its role from Editor to whichever role(s) that best represent theaccess needs for your App Engine app.

To modify roles for the App Engine default service account:

1. In the Google Cloud console, go to theIAM page.

   Go to IAM

2. Select your project.

3. Locate the App Engine default service account in thePrincipals list. The App Engine default service account appears inthe list if roles have been automatically or manually granted to theservice account.

4. Select the edit button to modify the roles assigned to the service account.

Your App Engine app uses the credentials of the App Engineservice account by default. For more information, seeGranting your app accessto Cloud services.

Restoring a deleted default service account

If you delete your App Engine default service account, yourApp Engine application might break and lose access to otherGoogle Cloud services, such as Datastore.

You can restore App Engine default service accounts that have been deletedwithin the last 30 days by following the steps inundeleting a service account.

More information about service accounts

• Default service accounts

• Managing service accounts