Treat App Engine apps as a "first-class citizen" for gcloud.storage.acls ?

(This is in reference to https://cloud.google.com/storage/docs/object-change-notification#_Application_Example)

In the example where you can set up notifications, I stumbled across the following command for gsutil:

gsutil acl ch -u ApplicationId@appspot.gserviceaccount.com:FC gs://BucketName

In this example, we're effectively saying "Give ApplicationId (an AppEngine application) full control (FC) to the bucket called BucketName".

This made me realize that we have "users" (which is what this uses), "groups", and "domains".. Can we add an .app() method (not married to that name... maybe .appengine())? It would effectively be an alias for .user() but appends "@appspot.gserviceaccount.com". This way, my code would look like:

bucket = get_bucket(...)
bucket.acl.app('my-appengine-app').grant_read()

Currently we have to do...

bucket = get_bucket(...)
bucket.acl.app('my-appengine-app@appspot.gserviceaccount.com').grant_read()

and we have to know that magical suffix (which I don't think is really well documented).

Thoughts?

I worry that the suffix is not universal across all GAE apps.

To try to verify, I have some really old and really new / created through Cloud Console (instead of on appengine.google.com) and they both have service accounts ending in @appspot.gserviceaccount.com. So maybe I'm worried about nothing.