To complete this transfer, you need the 'storage.buckets.setIamPolicy' permission for the source bucket

user_11342563 0
Viewed 2505

I am getting this error when trying to create a "transfer" to transfer the contents of one bucket in Google Cloud to another bucket in Google Cloud under the same owner:

To complete this transfer, you need the 'storage.buckets.setIamPolicy' permission for the source bucket. Ask the bucket's administrator to grant you the required permission and try again.

I have no idea what I'm supposed to do. I tried going to "Bucket -> Permissions -> Add Members -> myemail.com for Storage -> ...Admin" but I just keep getting "IAM policy update failed".

Please help on what to do to get this working so I can make my files publicly accessible.

I am using Node.js if that helps.

If I even try to fetch the photo and bypass it directly, I can't even do that :/

const { Storage } = require('@google-cloud/storage')

const storage = new Storage({
  projectId: 'my-bucket'
})

const bucket = storage.bucket('my.bucket')


app.get('/photo/:photo.:ext', (req, res) => {
  const remoteFile = bucket.file(`photo/${req.params.photo}.${req.params.ext}`)
  remoteFile.createReadStream().pipe(res)
})

Can't do this either:

const opts = {
  includeFiles: true
};

bucket.makePublic(opts, function(err, files) {
  // `err`:
  //    The first error to occur, otherwise null.
  //
  // `files`:
  //    Array of files successfully made public in the bucket.
  console.log(arguments)
});

Cannot get legacy ACLs for a bucket that has enabled Bucket Policy Only. Read more at https://cloud.google.com/storage/docs/bucket-policy-only.

$ gsutil iam ch allUsers:objectViewer gs://my.bucket
ServiceException: 401 Anonymous caller does not have storage.buckets.getIamPolicy access to my.bucket.
google-iam google-cloud-storage
2 Answers

The error clearly indicates a missing permission on the Source bucket. I recommend you confirm that the Owner on the Source bucket has the Permission, storage.objects.getIamPolicy(IAM&admin --> IAM Menu --> Filter by the Owner's email address --> check the role on it). Then, you can check if the roles has that permission, storage.objects.getIamPolicy (go to IAM&admin -->Roles and then, search for specific role --> Click on it and it would show the list of assigned permission. Ensure that storage.objects.getIamPolicy is one of the permissions listed for the Role

Meanwhile, for you to be able to grant access to specific buckets, your account role must be a Storage Admin. So, if your account does not have that role, you would need someone that has that role to be able to grant access or have other control over the bucket

user_94289250

I expect you have found a solution to this on your own. But for anyone getting the same error message i got this when trying to set up a transfer from the cloud console. I had done a transfer before between these two storage buckets and not changed the name of the transfer, so the second time trying this the suggested name was the same as the previous. I changed the transfer name to a unique one and that solved the issue for me.

No idea why i kept getting this error message as permissions was not part of the problem.

user_106463240
Related