CODEWITHSUNDEEP
google-cloud-platformgoogle-cloud-storagegoogle-iamgoogle-cloud-console
Martin Wiebusch
Martin Wiebusch

Reputation: 1803

GCS 'Storage Object Viewer' role cannot view objects

I am trying to give a user read access to a Google Cloud Storage bucket. The user has the "Storage Object Viewer" role

Role: Storage Object Viewer

but the user cannot see the items in the bucket:

Error message

The project ID is valid and according to the docs the "Storage Object Viewer" role includes the storage.buckets.list permission (EDIT: This is incorrect, see https://cloud.google.com/storage/docs/access-control/iam-roles#standard-roles).

The user can access the bucket if I give him the "Storage Object Admin" role, but then he also has write access. How do I just grant read access?

Upvotes: 5

Views: 8105

Answers (2)

boneill42
boneill42

Reputation: 51

It looks like "Storage Insights Collector Service" has the storage.buckets.get privilege. https://cloud.google.com/storage/docs/access-control/iam-roles

Use that.

Upvotes: 0

Atef Hares
Atef Hares

Reputation: 4891

According to docs, Storage Object Viewer does not have storage.buckets.list permission! it only contains the following 4 permissions (see the screenshot).

enter image description here

This means that the identity that has this role can only list/view objects inside a bucket and will not be allowed to list buckets and/or view bucket details.

if you need the identity to also list/view buckets, there is another predefined legacy role that you can use, named Storage Legacy Bucket Reader. See here

Upvotes: 8

Related Questions