Menu
I have created a service account in Google Cloud Console and selected role Storage / Storage Admin (i.e. full control of GCS resources).
gcloud projects get-iam-policy my_project seems to indicate that the role was actually selected:
- members: - serviceAccount:my_sa@my_project.iam.gserviceaccount.com role: roles/storage.admin - members: - serviceAccount:my_sa@my_project.iam.gserviceaccount.com role: roles/storage.objectAdmin - members: - serviceAccount:my_sa@my_project.iam.gserviceaccount.com role: roles/storage.objectCreator And documentation clearly indicates that role roles/storage.admin comprises permissions storage.objects.* (as well as storage.buckets.*).
But when I try using that service account in conjunction with the Google Cloud Storage Client Library for Python, I receive this error message:
my_sa@my_project.iam.gserviceaccount.com does not have storage.objects.get access to my_project/my_bucket.
So why would the selected role not be sufficient in this context?
505
The error you get means that your Cloud Function service account is lacking the storage. objects. create permission. In order to fix it, you can either give your service account a predefined role like Storage Object Creator or create a custom role with that permission.
A service account is a special type of Google account intended to represent a non-human user that needs to authenticate and be authorized to access data in Google APIs. Typically, service accounts are used in scenarios such as: Running workloads on virtual machines (VMs).
The problem was apparently that the service account was associated with too many roles, perhaps as a results of previous configuration attempts.
These steps resolved the issue:
my_sa under IAM & Admin / IAM my_sa under IAM & Admin / Service accounts my_sa (again with role Storage / Storage Admin)Effects are like this:
my_sa shows up with one role (Storage Admin) under IAM & Admin / IAM my_sa shows up as member under Storage / Browser / my_bucket / Edit bucket permissions
78
It's worth to note, that you need to wait a minute or something for permissions to be working in case you just assigned them. At least that's what happened to me after:
gcloud projects add-iam-policy-binding xxx --member "serviceAccount:[email protected]" --role "roles/storage.objectViewer" If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
