Skip to content

Writing to a bucket should be possible without 'storage.buckets.get' #3432

Closed
Closed
Writing to a bucket should be possible without 'storage.buckets.get'#3432
Assignees
akauppi
Labels
priority: p2Moderately-important priority. Fix may not be included in next release.type: feature request‘Nice-to-have’ improvement, new feature or different behavior or design.

Description

@akauppi
akauppi
opened on Jul 9, 2018

I wish to have a service account be able to write, read, read metadata and read history of objects in a pre-defined and existing bucket. It does not need to be able to do anything about the bucket, itself.

From the Cloud Storage IAM Roles page..

Role Description Permissions
roles/storage.objectAdmin Full control over objects, including listing, creating, viewing, and deleting objects. Does not grant permission to read or edit bucket metadata. storage.objects.*
roles/storage.admin Full control of buckets and objects. storage.buckets.*, storage.objects.*

..it seems roles/storage.objectAdmin would be the role for this.

If I run the (below) code with it, I get the error:

... does not have storage.buckets.get access to .

Adding the "Storage Admin" or "Storage Legacy Bucket Reader" role makes things work.

The possible bug is that I find the reality and the documentation to be at odds. It may be that this is the same thing as google-cloud-ruby has had (and fixed) in their #1588. Their it was fixed in a way that allows accessing a bucket without bucket-level rights.

Scala code:

val sto: Storage = StorageOptions.getDefaultInstance.getService()
val bucket: Bucket = sto.get(bucketName)
bucket.create("abc", "ABC!".getBytes(UTF_8) )

Using google-cloud-storage client version 1.31.0

Activity

  1. akauppi
    changed the title [-]Writing to Cloud Storage should be possible without 'storage.buckets.get' rights[/-] [+]Writing to a bucket should be possible without 'storage.buckets.get' permission[/+] on Jul 9, 2018
  2. akauppi
    changed the title [-]Writing to a bucket should be possible without 'storage.buckets.get' permission[/-] [+]Writing to a bucket should be possible without 'storage.buckets.get'[/+] on Jul 9, 2018
  3. andreamlin
    added
    type: feature request‘Nice-to-have’ improvement, new feature or different behavior or design.
    priority: p2Moderately-important priority. Fix may not be included in next release.
    on Jul 9, 2018

  4. andreamlin commented on Jul 9, 2018

    @andreamlin
    andreamlin
    on Jul 9, 2018
    Contributor

    Hello, would it be possible to skip the bucket fetch sto.get(bucketName) call, and instead use sto.create(blobinfo, options)? See Storage.java for method signature and sample call.

  5. akauppi commented on Jul 10, 2018

    @akauppi
    akauppi
    on Jul 10, 2018
    Author

    @andreamlin That seems to help - thanks. :)

    Also, your suggestion answered another question I had, about how to write custom metadata with the Java client.

  6. akauppi
    closed this as completedon Jul 10, 2018
  7. JustinBeckwith
    assigned
    akauppi
    on Feb 1, 2021
  8. suztomo
    added a commit that references this issue on Mar 9, 2026

    deps: update actions/upload-artifact action to v4.3.5 (#3432)

    b7e8244
  9. chingor13
    added 4 commits that reference this issue on Mar 24, 2026

    deps: update dependency packaging to v24.2 (#3432)

    bae5f48

    chore(main): release 2.51.0 (#3382)

    5b203a2

    chore: Update generation configuration at Sun Oct 27 02:27:19 UTC 2024 (

    1a8b2cb

    chore(main): release 2.61.1-SNAPSHOT (#3432)

    f4c5b80
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

priority: p2Moderately-important priority. Fix may not be included in next release.type: feature request‘Nice-to-have’ improvement, new feature or different behavior or design.

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions