7

My confusion is why I need to include "Legacy" cloud storage roles. I prefer to avoid things that say "legacy" as it sounds like they'll be deprecated one of these days. Am I doing it wrong?

Here's my case:

I'm using service account from an appengine project to access files from cloud storage in another project. I'm using the Google Python Client to access the data.

I have assigned roles:

Storage Object Creator
Storage Object Viewer

But when I try to access files I get an error:

<service account> does not have storage.buckets.get access

It's only once I add "legacy roles" that it finally has access:

Storage legacy bucket writer
Storage legacy bucket reader

Here's the code:

def download_blob(bucket_name, source_blob_name, destination_file_name):
    """Downloads a blob from the bucket."""
    bucket = storage_client.get_bucket(bucket_name)
    blob = bucket.blob(source_blob_name)
    blob.download_to_filename(destination_file_name)

    print('Blob {} downloaded to {}.'.format(
          source_blob_name,
          destination_file_name))

def upload_blob(bucket_name, source_file_name, destination_blob_name):
    """Uploads a file to the bucket."""
    bucket = storage_client.get_bucket(bucket_name)
    blob = bucket.blob(destination_blob_name)
    blob.upload_from_filename(source_file_name)

    print('File {} uploaded to {}.'.format(
          source_file_name,
          destination_blob_name))

Thanks Rob

3
  • Hi Rob, can you provide the code you're using? Commented Jul 20, 2018 at 16:46
  • @FrankNatividad added.
    – Rob Curtis
    Commented Jul 20, 2018 at 18:19
  • This is an old question, but we're facing a similar issue. Despite assigning the storage admin role, I cannot access storage. Unfortunately, I can't assign legacy roles to the service account. How did you resolve this problem?
    – ibrahim
    Commented Jul 9 at 12:12

1 Answer 1

9

W.r.t to your code, I've added additional comments below:

def download_blob(bucket_name, source_blob_name, 
destination_file_name):
    """Downloads a blob from the bucket."""
    """The following .get_bucket() requires storage.buckets.get permission."""
    bucket = storage_client.get_bucket(bucket_name)
    """The following doesn't"""
    bucket = storage_client.bucket(bucket_name)
    blob = bucket.blob(source_blob_name)
    blob.download_to_filename(destination_file_name)

    print('Blob {} downloaded to {}.'.format(
          source_blob_name,
          destination_file_name))

To re-iterate:

storage_client.get_bucket(bucket_name) requires permission for storage.bucket.get because it's performing a bucket metadata GET request.

storage_cilent.bucket(bucket_name) doesn't require this permission because it does not perform a GET request and only creates a bucket object with the name defined by bucket_name.

For upload to bypass storage.buckets.get issue:

from google.cloud import storage
storage_client = storage.Client()
bucket = storage_client.bucket(bucket_name)
blob = bucket.blob(source_blob_name)
blob.upload_from_filename(source_file_name)
7
  • Thanks. That seems completely strange to me; in both cases I'm reading from the same bucket, so i don't get why it doesn't work with get_bucket. But thanks.
    – Rob Curtis
    Commented Jul 21, 2018 at 6:28
  • 1
    Thanks for the feedback. I'd like to better answer the question so you understand it. get_bucket performs a get request on bucket metadata resource. When you don't want to do that only download the file. So instead you'd use bucket to create a reference to the bucket with its name, but not perform a GET request on bucket metadata. Commented Jul 22, 2018 at 23:56
  • 1
    @frank-natividad I have a similar issue, and this doesn't explain it to me. If I give the service account Storage Legacy Bucket Reader and Storage Legacy Bucket Writer roles, our code writes as expected, but if instead I give it the Storage Object Creator role, it fails with <service account> does not have storage.buckets.get access to <bucket>. Is there not a non-legacy, non-admin role that can write? Commented Sep 5, 2018 at 16:39
  • The Python client library has a way to initialize an instance of a Bucket with and without requesting metadata from GCS. w.r.t request metadata from GCS (storage.get_bucket()) If a request for metadata is performed from GCS it requires storage.buckets.get. w.r.t not requesting metadata from GCS (storage.bucket()). The method only initializes an instance of a bucket and does not request metadata. This allows you to skip needing permission storage.buckets.get because no metadata was retrieved. Commented Sep 5, 2018 at 21:34
  • @FrankNatividad I'm not looking to bypass the metadata request. I'm asking for a non-legacy, non-admin role that can write. It seems to me like a bug that a service account with Storage Object Creator permission can't write. Commented Sep 13, 2018 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.