Cloud IAM permissions for the Google Cloud Platform Console

The following page discusses the Cloud Identity and Access Management (Cloud IAM) permissions required to perform various actions on Cloud Storage buckets and objects when using the GCP Console.

Common permissions required for using the GCP Console

Certain permissions are broadly necessary in order to use the GCP Console:

• All actions involving buckets require resourcemanager.projects.get and storage.buckets.list permissions at the project level.

  These permissions allow you to access the buckets page of the Console Browser where you create, view, and update buckets.

• All actions involving objects require storage.objects.list permission at the project or bucket level.

  This permission allows you to access object pages of the Console Browser where you upload, view, and modify objects.

• All actions that include a billing project in the request require serviceusage.services.use permission for the project that's specified.

  This permission ensures you are authorized to bill the project you specify. Including a billing project is used, for example, when accessing a bucket with Requester Pays enabled.

Permissions required for specific actions

Action	Required Cloud IAM Permissions (in addition to those listed above)
Create a bucket	storage.buckets.create
List or filter buckets	No additional permissions
Access the Overview tab of a bucket	storage.buckets.get
View or edit the website configuration of a bucket (if enabled)	storage.buckets.get
	storage.buckets.update
Change bucket labels, default storage class, or default event-based hold	storage.buckets.get
	storage.buckets.update
Enable the Requester Pays feature	storage.buckets.get
	storage.buckets.update
Disable the Requester Pays feature	storage.buckets.get
	storage.buckets.update
	resourcemanager.projects.createBillingAssignment^3
Set or update object lifecycle policies	storage.buckets.get
	storage.buckets.update
View object lifecycle policies	storage.buckets.get
Set or remove a bucket's default Cloud Key Management Service key	storage.buckets.get
	storage.buckets.update
View a bucket's default Cloud Key Management Service key	storage.buckets.get
Set, remove, or lock a bucket's retention policy	storage.buckets.get
	storage.buckets.update
View a bucket's retention policy	storage.buckets.get
Set or remove Bucket Policy Only for a bucket	storage.buckets.get
	storage.buckets.update
View a bucket's Bucket Policy Only status	storage.buckets.get
Change bucket permissions	storage.buckets.get
	storage.buckets.getIamPolicy
	storage.buckets.setIamPolicy
	storage.buckets.update
Delete an empty bucket	storage.buckets.delete
	storage.objects.list
Delete a non-empty bucket	storage.buckets.delete
	storage.objects.delete
	storage.objects.list
Upload an object	storage.objects.create
View or download an object	storage.objects.get
List objects in a bucket	No additional permissions
Use the public access column to determine how an object is publicly accessible.	storage.objects.getIamPolicy^4
Rename an object	storage.objects.create
	storage.objects.delete
	storage.objects.get
	storage.objects.getIamPolicy^4
	storage.objects.setIamPolicy^4
Copy an object	storage.objects.create (for the destination bucket)
	storage.objects.delete^1 (for the destination bucket)
	storage.objects.get (for the source object)
	storage.objects.getIamPolicy^2^,4 (for the source object)
	storage.objects.setIamPolicy^2^,4 (for the destination bucket)
Move an object	storage.objects.create (for the destination bucket)
	storage.objects.delete^1 (for the destination bucket)
	storage.objects.delete (for the source bucket)
	storage.objects.get (for the source object)
	storage.objects.getIamPolicy^2^,4 (for the source object)
	storage.objects.setIamPolicy^2^,4 (for the destination bucket)
Share an object	storage.objects.get
	storage.objects.getIamPolicy^4
	storage.objects.setIamPolicy^4
	storage.objects.update
Edit an object's permissions	storage.objects.get
	storage.objects.getIamPolicy^4
	storage.objects.setIamPolicy^4
	storage.objects.update
Edit an object's metadata	storage.objects.get
	storage.objects.update
Add or remove a hold on an object	storage.objects.get
	storage.objects.update
Delete an object	storage.objects.delete

¹This permission is only required when the copied/moved object has the same name as an object that already exists in the bucket.

²This permission is only required when keeping the permissions currently applied to the source object.

³This permission is only required if you do not include a billing project in your request. See Requester Pays Use and access requirements for more information.

⁴This permission does not apply to buckets with Bucket Policy Only enabled.

What's next

• For a list of roles and the permissions they contain, see Cloud IAM Roles for Cloud Storage.