Give Full access control to a user on a cloud storage bucket

Question

I am a project owner and i have full control over the bucket. I would like to give another user the FULL access control over this bucket, but I didn't manage to do it. The mail of this user is [email protected] and he is listed as owner of the project, but can't have, as said before, full control over the bucket.

I tried also to give him access via gsutil: this is a snippet if the output of getacl.

  <EmailAddress>[email protected]</EmailAddress>
                <Name>User Name</Name>
            </Scope>
        <Permission>FULL_CONTROL</Permission>

If he logs in the Cloud storage console, he can't for example, change the permission of an object and so on.

Could you please give some hints on how to proceed?

Answer 1

Changing the bucket ACL will grant full control access over the bucket, which will allow reading, writing, and changing bucket metadata.

However, if you want a user to have full control over all objects in the bucket, you need to change the default object ACL, which is what is applied to objects that are created in that bucket. To change the default object ACL, you should be able to use a command such as:

gsutil defacl ch -u <email_address>:FC <bucket name>

Since this will only apply to objects created after the default object ACL has been updated, you'll also need to set the object ACL for any existing objects that you want to grant access to. If you want to grant access to all objects in the bucket, you could use a command like:

gsutil acl ch -u <email_address>:FC <bucket name>/**

If you have many existing objects in this bucket, you can add the -m flag (gsutil -m acl ch ...) to use multiprocessing for speed.

For detailed information about how ACLs work, take a look at https://developers.google.com/storage/docs/accesscontrol#default