Has anyone worked with a google bucket + iam + condition?
Created a service account with the Storage Admin role and added the condition:
resource.type == "storage.googleapis.com/Bucket" &&
resource.name.startsWith("projects/_/buckets/stagestorage")
While loading the file to storage, I get
Error 403: my-sa@cloudbuild.gserviceaccount.com does not have storage.objects.create access to the Google Cloud Storage object, forbidden...
But if only resource.name.startsWith("projects/_/buckets/stagestorage") is left in the condition, then everything works. I also tried changing the role to Storage Object Admin, but the result is the same.
Maybe 'resource.type' is a redundant condition?