Service account does not upload even with permission (Cloud Storage + IAM)

Google Cloud Compute Infrastructure
2

Hi @rrotter ,

Welcome to Google Cloud Community!

Based on the error you receive, your access account still doesn’t have the storage.buckets.get permission required. You need to check if the IAM policies applied to bucket level and inherited from the project level.

To check bucket-level policy:

gcloud storage buckets get-iam-policy gs://[bucket-name] --format=json

To check project-level policy:

gcloud projects get-iam-policy [project-ID] --format=json

Another way To allow a service account to upload files only to a specific ‘folder’ (path prefix) within a bucket, grant it the roles/storage.objectCreator role combined with an IAM Condition that restricts object creation to that prefix

  1. Go to the Google Cloud Console → Cloud Storage → Buckets → Select your bucket.
  2. Click the “PERMISSIONS” tab.
  3. Click “+ GRANT ACCESS”.
  4. Enter the email address(es) of the user(s) or service account(s) you want to grant upload access to.
  5. Assign Role:
    1. Click “Select a role”.
    2. Filter by typing “Object Creator”.
    3. Select the Storage Object Creator (roles/storage.objectCreator) role.
  6. Add IAM Condition (Crucial Step):

    1. Click “+ ADD IAM CONDITION”.

    2. Give it a descriptive title

    3. Select “Condition Editor".

    4. Condition: Use the resource.name attribute, which represents the full object path

      resource.name.startsWith("projects/_/buckets/[BUCKET NAME]/objects/[FOLDER NAME]")

      ``

  7. Click save
  8. Save the role binding.

This will allow the service account to upload files in the destination object starting with the folder name. But this role does not grant storage.objects.list. You can add the roles/storage.objectViewer also with condition.

Same steps mentioned above but change the assign role to “Object Viewer”.

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.

1 Like