3

How to give service account only access to one bucket? If you just in case wanna give another 3rd party service access to your private bucket?

The problem is by default (service account) has access to all buckets and I've no idea how to restrict it to only one bucket only.

Is it possible to achieve this from dashboard or only console? If it is possible from dashboard then I would like to know the steps of that.

Thank you.

Edit**

I have 3 buckets and when I create a service account with (Object Viewer) permission it automatically gets added to all 3 of them and when I try to delete it from permission of any of bucket I don't want it to have access to, I get this message saying (Member is inherited from another policy and cannot be deleted.)

2
  • Did you solve your problem?
    – Stiefel
    Mar 23, 2021 at 11:22
  • @Stiefel yes I figured the solution myself.
    – Newbie
    Jun 19, 2021 at 19:38

2 Answers 2

4

If you go to the Google Cloud Storage Console, you'll find a list of buckets for your GCP project. Click on the three vertical dots to the right of the relevant project, and choose "Edit bucket permissions". You can then use "Add member" to give appropriate permissions to the relevant service account.

3
  • I have 3 buckets and when I create a service account with (Object Viewer) permission it automatically gets added to all 3 of them and when I try to delete it from permission of any of bucket I don't want it to have access to, I get this message saying (Member is inherited from another policy and cannot be deleted.)
    – Newbie
    Jan 1, 2021 at 16:52
  • 1
    @Newbie: That's in the case where the service account and the buckets are in the same project, which isn't the scenario you described in the question. Note that I wasn't suggesting adding the role to the service account itself - you wouldn't be able to do that for a service account you don't have access to, after all. I'm suggesting adding permission for the service account just to the bucket, which would apply to the scenario you described.
    – Jon Skeet
    Jan 1, 2021 at 17:03
  • 1
    @Newbie - Jon's answer is correct in the context of your question. Edit your question with details on the service account, who owns it and who owns the bucket. Are the projects in an organization? For matters relating to security and access control, you must be precise and detailed. A 3rd party service account would not have inherited permissions in your project unless it was already added at a higher level (folder, org) or to the project that owns the bucket. Jan 1, 2021 at 18:29
3

You need to create an IAM entry and restrict access by specifying a condition.

For example, if I want the user user.email@domain.ext to access the bucket b_1with the permission Storage Object Admin

  1. Browse to your bucket b_1
  2. On the kebab menu (three vertical dots) > edit access
  3. Add principal : user.email@domain.ext
  4. Specify role : Storage Object Admin
  5. Specify condition
    • enter the Title of condition
    • enter a Description
    • In the Condition Builder select Condition type : Resource > Name
    • In Operator select is or Starts With, etc..
    • Enter your bucket name projects/_/buckets/b_1
  6. You may want to enter an other Conditions type such as Resource> Typeand select storage.googleapis.com/Bucket
2
  • It does not work; it requires buckets.lists permission; this will show all the buckets to the principal user.
    – Mahdi
    Sep 5, 2022 at 20:04
  • 2
    The answer should be updated, as the resoruce name for buckets is projects/_/buckets/<your-bucket> yes, it is an underscore. See docs: cloud.google.com/iam/docs/conditions-resource-attributes
    – Bonzogondo
    Oct 3, 2022 at 11:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.