I am looking for a documented, supported least-privilege configuration for Cloud Build log writing, not source upload or artifact storage.
Setup:
- One manually submitted Cloud Build with an explicitly specified user-managed build service account.
- options.logging = GCS_ONLY; logsBucket points to an already-created regional Cloud Storage bucket in the same project.
- Uniform bucket-level access, public access prevention, no bucket retention policy, and seven-day soft delete.
- Our security requirements prohibit granting roles/storage.admin. We want a justified bucket-scoped custom role rather than escalating grants through trial builds.
The guide at Store and view build logs | Cloud Build | Google Cloud Documentation recommends Storage Admin and mentions alternative roles. The legacy service-account permission table groups log, source and artifact workflows together, so it does not establish the exact log-only requirements.
Could you clarify:
- Which principal is checked for writing/finalizing GCS build logs: the specified build service account, a service agent, or both?
- What exact permissions form a supported sufficient set on this pre-created bucket? Is storage.objects.create enough, or are get/list/update/delete and storage.buckets.get also required?
- Does streaming/finalization overwrite or compose log objects, and which permissions are needed for that behavior?
- Are any project-level permissions required solely for this logging path, excluding build submission, source staging, artifact upload, optional log viewing and bucket creation?
A documentation reference or service-level explanation for each mandatory permission would be very helpful. We have not run a trial build to infer these requirements. Thank you.