Getting 403 error but version is getting deployed with 0% traffic - google-app-engine

Question

I am using maven plugin 1.9.60 with JDK 8
Running command
mvn install appengine:update -Dappengine.additionalParams="--service_account_json_key_file=client-secret.json"
I could see the version deployed but 0% traffic. Logs says error as below. Could someone suggest how to fix this?
Beginning interaction for module default...
0% Created staging directory at: '/var/folders/ny/z92xw4ps0j71v43mnvjzjyd80000gn/T/appcfg7082099622802800350.tmp'
5% Scanning for jsp files.
8% Generated git repository information file.
20% Scanning files on local disk.
25% Initiating update.
28% Cloning 34 application files.
40% Uploading 2 files.
52% Uploaded 1 files.
61% Uploaded 2 files.
68% Sending batch containing 2 file(s) totaling 1KB.
73% Initializing precompilation...
90% Deploying new version.
95% Closing update: new version is ready to start serving.
98% Uploading index definitions.
Feb. 19, 2018 12:54:48 AM com.google.appengine.tools.admin.AbstractServerConnection send1
WARNING: Error posting to URL: https://appengine.google.com/api/datastore/index/add?app_id=clean-aleph-191303&version=beta-001&
403 Forbidden
You do not have permission to modify this app (app_id=u'f~clean-aleph-191303').
This is try #0
Feb. 19, 2018 12:54:48 AM com.google.appengine.tools.admin.AbstractServerConnection send1
WARNING: Error posting to URL: https://appengine.google.com/api/datastore/index/add?app_id=clean-aleph-191303&version=beta-001&
403 Forbidden
You do not have permission to modify this app (app_id=u'f~clean-aleph-191303').
This is try #1
Feb. 19, 2018 12:54:49 AM com.google.appengine.tools.admin.AbstractServerConnection send1
WARNING: Error posting to URL: https://appengine.google.com/api/datastore/index/add?app_id=clean-aleph-191303&version=beta-001&
403 Forbidden
You do not have permission to modify this app (app_id=u'f~clean-aleph-191303').
This is try #2
Feb. 19, 2018 12:54:49 AM com.google.appengine.tools.admin.AbstractServerConnection send1
WARNING: Error posting to URL: https://appengine.google.com/api/datastore/index/add?app_id=clean-aleph-191303&version=beta-001&
403 Forbidden
You do not have permission to modify this app (app_id=u'f~clean-aleph-191303').
This is try #3
Error Details:
2018-02-19 00:54:17.700:INFO::main: Logging initialized #409ms
2018-02-19 00:54:17.816:INFO:oejs.Server:main: jetty-9.3.18.v20170406
2018-02-19 00:54:19.481:INFO:oeja.AnnotationConfiguration:main: Scanning elapsed time=1228ms
2018-02-19 00:54:19.497:INFO:oejq.QuickStartDescriptorGenerator:main: Quickstart generating
2018-02-19 00:54:19.512:INFO:oejsh.ContextHandler:main: Started o.e.j.q.QuickStartWebApp#2aceadd4{/,file:///private/var/folders/ny/z92xw4ps0j71v43mnvjzjyd80000gn/T/appcfg7082099622802800350.tmp/,AVAILABLE}
2018-02-19 00:54:19.514:INFO:oejs.Server:main: Started #2231ms
2018-02-19 00:54:19.517:INFO:oejsh.ContextHandler:main: Stopped o.e.j.q.QuickStartWebApp#2aceadd4{/,file:///private/var/folders/ny/z92xw4ps0j71v43mnvjzjyd80000gn/T/appcfg7082099622802800350.tmp/,UNAVAILABLE}
com.google.appengine.tools.admin.HttpIoException: Error posting to URL: https://appengine.google.com/api/datastore/index/add?app_id=clean-aleph-191303&version=beta-001&
403 Forbidden
You do not have permission to modify this app (app_id=u'f~clean-aleph-191303').
Unable to update app: Error posting to URL: https://appengine.google.com/api/datastore/index/add?app_id=clean-aleph-191303&version=beta-001&
403 Forbidden
You do not have permission to modify this app (app_id=u'f~clean-aleph-191303').
appengine-web.xml
```
<?xml version="1.0" encoding="utf-8"?>
<appengine-web-app xmlns="http://appengine.google.com/ns/1.0">
<application>clean-aleph-191303</application>
<version>beta-001</version>
<threadsafe>true</threadsafe>
<runtime>java8</runtime>
</appengine-web-app>
```
pom.xml (plugin declaration)
```
<plugin>
<groupId>com.google.appengine</groupId>
<artifactId>appengine-maven-plugin</artifactId>
<version>1.9.60</version>
</plugin>
```
Complete bitbucket repo can be found here.
https://bitbucket.org/rohgoyal/springbootgcp-example/src

Answer 1

The issue you are experiencing is due to a missing role on the service account. It probably has the "App Engine Deployer" role assigned but it is missing the "Datastore Index Admin" role and this causes the 403s while POSTing to appengine.google.com/api/datastore/index/
After adding that role, you'll need to regenerate the private key (client-secret.json as you've named it) because the old one won't have the new permissions.
Some more information on roles needed to deploy GAE apps can be found on Deploying using IAM roles section.
Note: Thanks for providing a full repro. It is always helpful.