Writing to GCS bucket in Python with storage.objectAdmin permissions

user_603657 0
Viewed 969

I'm trying to figure out the minimum set of permissions that a service account needs in order to write a file to a GCS bucket. I was thinking I could use storage.objectAdmin, but using the sample code provided for the Python SDK it fails with an error: my-service-account@my-project.googleapis.com does not have storage.buckets.get access to my-bucket

client = _get_storage_client()
bucket = client.bucket(current_app.config['CLOUD_STORAGE_BUCKET'])
blob = bucket.blob(filename)

blob.upload_from_string(
    file_stream,
    content_type=content_type)

This is because the client.bucket call actually reads metadata from the bucket, which storage.objectAdmin does NOT grant. It fixes itself when I use storage.admin permissions, but that also allows the account to delete the entire bucket, which I don't want. Adding storage.legacyBucketReader also works, but then I'm using a legacy role which I'm not sure I should be doing anymore.

What's the best practice here?

google-cloud-storage google-cloud-platform python
2 Answers

If you'd like to be as restrictive as possible, you can add the following two permissions:

  • roles/storage.objectCreator
  • Viewer

This allows the grantee to do the following:

  • Can create new objects.
  • Can list buckets
  • Can also view bucket metadata, excluding ACLs, when listing.

More details here: https://cloud.google.com/storage/docs/access-control/iam-roles

user_3280360

Cloud Storage permissions are governed by both Cloud IAM and ACLs. Essentially, you can use both to allow a Service Account to write to a bucket. This is done by setting the WRITER permission to the desired Service Account, e.g:

gsutil acl ch -u my-service-account:W gs://my-bucket

After applying this change to the ACL, I was able to upload to the GCS bucket. You can find more examples here.

user_91468200
Related