If you refer to the "Predefined App Engine roles"
sub-chapter of the "Access Control" online document, you'll notice that only the App Engine Deployer role has "Write access only to deploy and create a new version". Other roles, such as viewer, or code viewer, have just read-only access. In other words, you need to assign the the App Engine Deployer role to your service account, to enable deployment. You need to enable App Engine API as well.