目的地值區或其專案不得設有使用值區資源類型 (storage.googleapis.com/Bucket) 或物件資源類型 (storage.googleapis.com/Object) 的 IAM 限制條件。如果專案中的任何值區都設有使用這兩種資源類型之一的 IAM 限制條件，則即使後來移除限制條件，也無法將受管理的資料夾轉移至該專案中的任何值區。
不支援事件導向轉移作業。
不支援資訊清單轉移。
IAM 權限
Google 管理的服務帳戶需要下列 Google Cloud 身分與存取權管理 (IAM) 權限。
將受管理的資料夾權限授予 Google 管理的服務帳戶，即可讓該帳戶修改目的地資料夾的 IAM 政策，如果是在專案層級授予角色，則可修改所有資料夾的 IAM 政策。這會帶來安全性風險：具備工作編輯權限的使用者可能會利用這項功能，將權限授予惡意人士。為降低這類風險，建議您在專屬 Google Cloud 專案中隔離受管理的資料夾轉移作業。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-03 (世界標準時間)。"],[],[],null,["# Transfer Cloud Storage managed folders\n\n[Cloud Storage managed folders](/storage/docs/managed-folders) provide\nfine-grained access control to objects in Cloud Storage buckets. Permissions\ncan be set at a folder level within buckets that use universal bucket-level\naccess. When transferring objects between Cloud Storage buckets with\nStorage Transfer Service, these managed folder permissions can be retained.\n\nLimitations\n-----------\n\nThe following limitations apply to transfers of managed folders:\n\n- The destination bucket must use [uniform bucket-level access](/storage/docs/uniform-bucket-level-access).\n- Managed folder transfers do not support the `deleteObjectsUniqueInSink` or `deleteObjectsFromSourceAfterTransfer` options.\n- There must be no [IAM Conditions](/iam/docs/conditions-overview) on the destination bucket or its project that use the *bucket* resource type (`storage.googleapis.com/Bucket`) or the *object* resource type (`storage.googleapis.com/Object`). If any bucket within a project has an IAM Condition that uses either of these resource types, managed folders cannot be transferred to any of the buckets within that project, even if the condition is later removed.\n- Event-driven transfers are not supported.\n- Manifest transfers are not supported.\n\nIAM permissions\n---------------\n\nThe following Google Cloud Identity and Access Management (IAM)\npermissions are required by the Google-managed service account.\n\nFor both the source and the destination, permissions can be set at the bucket\nlevel, or can be\n[set on the managed folder](/storage/docs/access-control/using-iam-for-managed-folders).\nTo set permissions on a destination managed folder, that folder must already\nexist.\n\nWe do not recommend setting managed folder permissions at a project level;\nsee [Security considerations](#security_considerations) for additional info.\n\nOn the source bucket or managed folder:\n\n- `storage.managedFolders.getIamPolicy`\n- `storage.managedFolders.list`\n- `storage.managedFolders.get`\n\nOn the destination bucket or managed folder:\n\n- `storage.managedFolders.setIamPolicy`\n- `storage.managedFolders.list`\n- `storage.managedFolders.create`\n\nThese are in addition to the standard permissions required by Storage Transfer Service:\n\n- [Configure access to a source: Cloud Storage](/storage-transfer/docs/source-cloud-storage)\n- [Configure access to a sink: Cloud Storage](/storage-transfer/docs/sink-cloud-storage)\n\nTo grant the required managed folder permissions,\n[create a custom role](/iam/docs/creating-custom-roles) with only the\npermissions required.\n\nCreate a managed folder transfer\n--------------------------------\n\nTo create a transfer containing a managed folder, specify\n`managedFolderTransferEnabled: true` in your `transferSpec`. You can optionally\nspecify a `path` value to transfer only a specific managed folder. \n\n POST https://storagetransfer.googleapis.com/v1/transferJobs\n {\n \"name\": \"transferjobs/\u003cvar translate=\"no\"\u003eNAME\u003c/var\u003e\",\n \"projectId\": \"\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\",\n \"transferSpec\": {\n \"gcsDataSource\": {\n \"bucketName\": \"\u003cvar translate=\"no\"\u003eSOURCE_BUCKET\u003c/var\u003e\",\n \"path\": \"\u003cvar translate=\"no\"\u003eSOURCE_PATH\u003c/var\u003e\",\n \"managedFolderTransferEnabled\": true\n },\n \"gcsDataSink\": {\n \"bucketName\": \"\u003cvar translate=\"no\"\u003eDESTINATION_BUCKET\u003c/var\u003e\",\n \"path\": \"\u003cvar translate=\"no\"\u003eDESTINATION_PATH\u003c/var\u003e\",\n }\n },\n \"status\": \"ENABLED\"\n }\n\nIf the correct managed transfer permissions are not set at the source and the\ndestination, the transfer fails.\n\nSee [Create transfers](/storage-transfer/docs/create-transfers?tab=rest#create-a-transfer)\nfor details on creating a transfer using the REST API, or refer to the\n[`transferJobs.create` reference](/storage-transfer/docs/reference/rest/v1/transferJobs/create).\n\nSecurity considerations\n-----------------------\n\nGranting managed folder permissions to a Google-managed service account enables\nthe account to modify IAM policies on destination folders, or on all folders\nif the role is granted at the project level. This poses a security risk:\na user with job edit permissions could exploit this to grant privileges to a\nmalicious actor. To mitigate this risk, consider isolating managed folder\ntransfers within a dedicated Google Cloud project.\n\nCloud Logging\n-------------\n\nManaged folder actions are logged by Cloud Logging. See\n[Cloud Logging for Storage Transfer Service](/storage-transfer/docs/transfer-logs)\nfor details.\n\nTroubleshooting\n---------------\n\nFor help creating and managing managed folders, refer to the\n[Troubleshooting](/storage/docs/troubleshooting#folders) page."]]
