CODEWITHSUNDEEP
google-cloud-platformgoogle-apigoogle-cloud-storage
Evgeny
Evgeny

Reputation: 427

GCS limit bucket access to an existing service account

Usually there is Compute Engine default service account that is created automatically by GCP, this account is used for example by VM agents to access different resources across GCP and by default has role/editor permissions.
Suppose I want to create GCS bucket that can only be accessed by this default service account and no one else. I've looked into ACLs and tried to add an ACL to the bucket with this default service account email but it didn't really work.
I realized that I can still access bucket and objects in this bucket from other accounts that have for example storage bucket read and storage object read permissions and I'm not sure what I did wrong (maybe some default ACLs are present?).

My questions are:

Thanks!

Upvotes: 0

Views: 1799

Answers (2)

guillaume blaquiere
guillaume blaquiere

Reputation: 75715

I recommend you not to use ACL (and Google also). It's better to switch the bucket in uniform IAM policy.

There are 2 bad side of ACL:

  • New created files aren't ACL and you need to set it everytime that you create a ne file
  • It's difficult to know who has and who hasn't access with ACL. IAM service is better for auditing.

When you switch to Uniform IAM access, Owner, Viewer, and Editor role no longer have access to buckets (the role/storage.admin isn't included in this primitive role). It could solve in one click all the unwanted access. Else, as John said, remove all the IAM permission on the bucket and the project that have access to the bucket except your service account.

Upvotes: 1

Sakshi Gatyan
Sakshi Gatyan

Reputation: 2116

You can control access to buckets and objects using Cloud IAM and ACLs.

For example grant the service account WRITE (R: READ,W: WRITE,O: OWNER) access to the bucket using ACLs:

gsutil acl ch -u [email protected]:W gs://my-bucket

To remove access of service account from the bucket:

   gsutil acl ch -d [email protected] gs://my-bucket

If There are roles such as role/StorageAdmin in the IAM identities (project level), they will have access to all the GCS resources of the project. You might have to change the permission to avoid them having access.

Upvotes: 0

Related Questions