Cloud IAM permissions for JSON methods

The following table lists the Cloud Identity and Access Management (Cloud IAM) permissions required to run each Cloud Storage JSON method on a given resource.

Resource	Method	Required Cloud IAM Permissions¹
`BucketAccessControls`	`delete`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`BucketAccessControls`	`get`	`storage.buckets.get`
`BucketAccessControls`	`get`	`storage.buckets.getIamPolicy`
`BucketAccessControls`	`insert`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`BucketAccessControls`	`list`	`storage.buckets.get`
`BucketAccessControls`	`list`	`storage.buckets.getIamPolicy`
`BucketAccessControls`	`patch`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`BucketAccessControls`	`update`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`Buckets`	`delete`	`storage.buckets.delete`
`Buckets`	`get`	`storage.buckets.get`
`Buckets`	`get`	`storage.buckets.getIamPolicy²`
`Buckets`	`getIamPolicy`	`storage.buckets.getIamPolicy`
`Buckets`	`insert`	`storage.buckets.create`
`Buckets`	`list`	`storage.buckets.list`
`Buckets`	`list`	`storage.buckets.getIamPolicy²`
`Buckets`	`lockRetentionPolicy`	`storage.buckets.update`
`Buckets`	`patch`	`storage.buckets.update`
		`storage.buckets.getIamPolicy³`
		`storage.buckets.setIamPolicy⁵`
`Buckets`	`setIamPolicy`	`storage.buckets.setIamPolicy`
`Buckets`	`testIamPermissions`	None
`Buckets`	`update`	`storage.buckets.setIamPolicy`
`Buckets`	`update`	`storage.buckets.update`
`Channels`	`stop`	None
`DefaultObjectAccessControls`	`delete`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`DefaultObjectAccessControls`	`get`	`storage.buckets.get`
`DefaultObjectAccessControls`	`get`	`storage.buckets.getIamPolicy`
`DefaultObjectAccessControls`	`insert`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`DefaultObjectAccessControls`	`list`	`storage.buckets.get`
`DefaultObjectAccessControls`	`list`	`storage.buckets.getIamPolicy`
`DefaultObjectAccessControls`	`patch`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`DefaultObjectAccessControls`	`update`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`Notifications`	`delete`	`storage.buckets.update`
`Notifications`	`get`	`storage.buckets.get`
`Notifications`	`insert`	`storage.buckets.update`
`Notifications`	`list`	`storage.buckets.get`
`ObjectAccessControls`	`delete`	`storage.objects.get`
		`storage.objects.getIamPolicy`
		`storage.objects.setIamPolicy`
		`storage.objects.update`
`ObjectAccessControls`	`get`	`storage.objects.get`
`ObjectAccessControls`	`get`	`storage.objects.getIamPolicy`
`ObjectAccessControls`	`insert`	`storage.objects.get`
		`storage.objects.getIamPolicy`
		`storage.objects.setIamPolicy`
		`storage.objects.update`
`ObjectAccessControls`	`list`	`storage.objects.get`
`ObjectAccessControls`	`list`	`storage.objects.getIamPolicy`
`ObjectAccessControls`	`patch`	`storage.objects.get`
		`storage.objects.getIamPolicy`
		`storage.objects.setIamPolicy`
		`storage.objects.update`
`ObjectAccessControls`	`update`	`storage.objects.get`
		`storage.objects.getIamPolicy`
		`storage.objects.setIamPolicy`
		`storage.objects.update`
`Objects`	`compose`	`storage.objects.create`
`Objects`	`compose`	`storage.objects.get`
`Objects`	`copy`	`storage.objects.create`
`Objects`	`copy`	`storage.objects.get`
`Objects`	`delete`	`storage.objects.delete`
`Objects`	`get`	`storage.objects.get`
`Objects`	`get`	`storage.objects.getIamPolicy²`
`Objects`	`insert`	`storage.objects.create`
`Objects`	`insert`	`storage.objects.delete⁴`
`Objects`	`list`	`storage.objects.list`
`Objects`	`list`	`storage.objects.getIamPolicy²`
`Objects`	`patch`	`storage.objects.get`
		`storage.objects.getIamPolicy`
		`storage.objects.update`
		`storage.objects.setIamPolicy³`
`Objects`	`rewrite`	`storage.objects.create`
`Objects`	`rewrite`	`storage.objects.get`
`Objects`	`update`	`storage.objects.setIamPolicy`
`Objects`	`update`	`storage.objects.update`
`Objects`	`watchAll`	`storage.buckets.update`
`Projects.serviceAccount`	`get`	`resourceManager.projects.get`

¹ If you use the userProject parameter or the x-goog-user-project header in your request, you must have serviceusage.services.use permission for the project ID that you specify, in addition to the normal Cloud IAM permissions required to make the request.

² This permission is only required if you want to include ACLs or Cloud IAM policies as part of a full projection. If you don't have this permission and request a full projection, you receive only a partial projection.

³ This permission is only required if you want to include ACLs or Cloud IAM policies as part of the response.

⁴ This permission is only required when the inserted object has the same name as an object that already exists in the bucket.

⁵ This permission is required if you want to include ACLs or Cloud IAM policies as part of the request.

What's next

For a list of roles and the permissions they contain, see Cloud IAM Roles for Cloud Storage.

¿Te sirvió esta página? Envíanos tu opinión:

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 3.0 License, and code samples are licensed under the Apache 2.0 License. For details, see our Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Última actualización: Abril 18, 2019

Cloud IAM permissions for JSON methods

What's next

Enviar comentarios sobre…