The following page discusses the Identity and Access Management (IAM) permissions required to perform various actions on Cloud Storage buckets and objects when using the Cloud Console. IAM permissions are bundled together to make roles, and you assign roles to users and groups.
Common permissions required for using the Cloud Console
Certain permissions are broadly necessary in order to use the Cloud Console:
All actions involving buckets require
resourcemanager.projects.getandstorage.buckets.listpermissions at the project level.These permissions allow you to access the buckets page of the Console Browser where you create, view, and update buckets.
Generally, actions involving objects require
storage.objects.listpermission at the project or bucket level.This permission is not required if you only access the details pages for specific objects and you never need to access the overall list of objects in a bucket.
All actions that include a billing project in the request require
serviceusage.services.usepermission for the project that's specified.This permission ensures you are authorized to bill the project you specify. Including a billing project is used, for example, when accessing a bucket with Requester Pays enabled.
Permissions required for specific actions
| Action | Required IAM Permissions (in addition to those listed above) |
|---|---|
| Create a bucket | storage.buckets.create |
| List or filter buckets | No additional permissions |
| Access the Overview tab of a bucket | storage.buckets.get |
| View or edit the website configuration of a bucket (if enabled) | storage.buckets.getstorage.buckets.update |
| Change bucket labels, default storage class, or default event-based hold | storage.buckets.getstorage.buckets.update |
| Enable the Requester Pays feature | storage.buckets.getstorage.buckets.update |
| Disable the Requester Pays feature | storage.buckets.getstorage.buckets.updateresourcemanager.projects.createBillingAssignment3 |
| Set or update object lifecycle policies | storage.buckets.getstorage.buckets.update |
| View object lifecycle policies | storage.buckets.get |
| Set or remove a bucket's default Cloud Key Management Service key | storage.buckets.getstorage.buckets.update |
| View a bucket's default Cloud Key Management Service key | storage.buckets.get |
| Set, remove, or lock a bucket's retention policy | storage.buckets.getstorage.buckets.update |
| View a bucket's retention policy | storage.buckets.get |
| Set or remove uniform bucket-level access for a bucket | storage.buckets.getstorage.buckets.update |
| View a bucket's uniform bucket-level access status | storage.buckets.get |
| Change bucket permissions | storage.buckets.getstorage.buckets.getIamPolicystorage.buckets.setIamPolicystorage.buckets.update |
| Delete an empty bucket | storage.buckets.deletestorage.objects.list |
| Delete a non-empty bucket | storage.buckets.deletestorage.objects.deletestorage.objects.list |
| Upload an object | storage.objects.create |
| View the details page for an object5 | storage.objects.get |
| Download an object5 | storage.objects.get |
| List objects in a bucket | No additional permissions |
| Determine if an object is publicly accessible5 | storage.buckets.getIamPolicystorage.objects.getIamPolicy4 |
| Rename an object | storage.objects.createstorage.objects.deletestorage.objects.getstorage.objects.getIamPolicy4storage.objects.setIamPolicy4 |
| Copy an object | storage.objects.createstorage.objects.delete1storage.objects.getstorage.objects.getIamPolicy2,4storage.objects.setIamPolicy2,4 |
| Move an object | storage.objects.createstorage.objects.delete1storage.objects.deletestorage.objects.getstorage.objects.getIamPolicy2,4storage.objects.setIamPolicy2,4 |
| View an object's access permissions5,6 | storage.objects.getstorage.objects.getIamPolicy |
| Edit an object's access permissions5,6 | storage.objects.getstorage.objects.getIamPolicystorage.objects.setIamPolicystorage.objects.update |
| Edit an object's metadata | storage.objects.getstorage.objects.update |
| Add or remove a hold on an object | storage.objects.getstorage.objects.update |
| Delete an object5 | storage.objects.delete |
| View the HMAC keys for a project | resourcemanager.projects.getstorage.hmacKeys.list |
| Create an HMAC key for a service account | resourcemanager.projects.getstorage.hmacKeys.liststorage.hmacKeys.create |
| Disable or re-enable an HMAC key for a service account | resourcemanager.projects.getstorage.hmacKeys.liststorage.hmacKeys.update |
| Delete an HMAC key for a service account | resourcemanager.projects.getstorage.hmacKeys.liststorage.hmacKeys.delete |
1This permission is only required when the copied/moved object has the same name as an object that already exists in the bucket.
2This permission is only required when keeping the permissions currently applied to the source object.
3This permission is only required if you do not include a billing project in your request. See Requester Pays Use and access requirements for more information.
4This permission does not apply to buckets with uniform bucket-level access enabled.
5This action does not require storage.objects.list
if it's performed on the details page for the relevant object.
6This action does not apply to buckets with uniform bucket-level access enabled.
What's next
For a list of roles and the permissions they contain, see IAM Roles for Cloud Storage.
Assign IAM roles at the project and bucket level.