title: Cloud Build fails to deploy to Google App Engine - You do not have permission to act as @appspot.gserviceaccount.com
body: <p>This morning I made a PR which triggered a Cloud Build for my staging enviroment but failed to deploy the results to GAE.</p>
  <p>The error was as follows:</p>
  <blockquote>
  <p>ERROR: (gcloud.app.deploy) PERMISSION_DENIED: You do not have permission to act as '[redacted]@appspot.gserviceaccount.com'
  Step #4: - '@type': type.googleapis.com/google.rpc.ResourceInfo
  Step #4:   description: You do not have permission to act as this service account.
  Step #4:   resourceName: [redacted]@appspot.gserviceaccount.com
  Step #4:   resourceType: serviceAccount</p>
  </blockquote>
  <p>When I look at <a href="https://console.cloud.google.com/cloud-build/settings/service-account" rel="noreferrer">https://console.cloud.google.com/cloud-build/settings/service-account</a>
  Cloud build has the follow service account permissions <strong>ENABLED</strong>:</p>
  <ul>
  <li>App Engine Admin</li>
  <li>Cloud KMS</li>
  </ul>
  <p>Checking <a href="https://console.cloud.google.com/iam-admin/iam" rel="noreferrer">https://console.cloud.google.com/iam-admin/iam</a>
  I can see that the cloudbuild service account has the following roles:</p>
  <ul>
  <li>App Engine Admin</li>
  <li>App Engine Deployer</li>
  <li>Cloud Build Service Account</li>
  <li>Cloud KMS CryptoKey Decrypter</li>
  </ul>