App Engine includes a [service agent](https://docs.cloud.google.com/iam/docs/service-account-types.md.txt#service-agents) named *App Engine flexible environment Service Agent* . This service agent enables your services to act on your behalf when accessing other Google Cloud resources. It is essential to keep the service agent unmodified. > [!WARNING] > **Warning:** If you remove the default role binding or modify the permissions granted to the service agent on your Google Cloud project, any deployment to your app in the App Engine flexible environment might fail. Note that the service agent is not listed on the **Service Accounts** page in the Google Cloud console and is unrelated to the [App Engine default service account](https://docs.cloud.google.com/appengine/docs/flexible/default-service-account). The service agent for your Google Cloud project is automatically created after you deploy your first service---for example, after you run the `gcloud app deploy` command for the first time to deploy an app in the flexible environment. The service agent uses the predefined IAM role [App Engine flexible environment Service Agent](https://docs.cloud.google.com/iam/docs/roles-permissions/appengineflex#appengineflex.serviceAgent), which includes a set of permissions needed by App Engine to manage your apps. This role is granted to the service agent automatically when the service agent is created. For example, the permissions allow your Google Cloud project to obtain an access token that your App Engine instances use to access other Google Cloud resources, such as a Cloud Storage bucket. **Important restrictions**: - Do not revoke the roles that are granted to the service agent. - Do not grant the related [App Engine flexible environment Service Agent role](https://docs.cloud.google.com/iam/docs/roles-permissions/appengineflex.md.txt#appengineflex.serviceAgent) to any other account. Note that the permissions in this role can change without notice. ## Verify the service agent To verify that the service agent has its required role in your Google Cloud project, perform the following steps: 1. In the Google Cloud console, go to the **Permissions** page. [Go to Permissions](https://console.cloud.google.com/iam-admin/iam) 2. In the upper-right corner of the **Permissions** page, select the **Include Google-provided role grants** checkbox. 3. In the **Principals** list, locate the service agent with the following ID: `service-PROJECT_NUMBER@gae-api-prod.google.com.iam.gserviceaccount.com`. 4. Verify that the service agent has been granted the **App Engine flexible environment Service Agent** role. ## Restore required role for the service agent If you accidentally remove the required **App Engine flexible environment Service Agent** role binding for the service agent from your Google Cloud project, restore it by performing the following steps: 1. In the Google Cloud console, go to the **Permissions** page. [Go to Permissions](https://console.cloud.google.com/iam-admin/iam) 2. Click **Add**. 3. Enter the service agent ID in the following format: `service-PROJECT_NUMBER@gae-api-prod.google.com.iam.gserviceaccount.com`. 4. Select the **App Engine flexible environment Service Agent** role. 5. Click **Save**.