2

Google Cloud Platform Storage Buckets can be directly exposed via HTTP. The recommended configuration for this is to have allUsers with the Storage Object Viewer role.

The Storage Object Viewer role has got storage.bucket.list permission. I tried creating a custom role based on this role and removed the storage.bucket.list permission.

I updated the IAM permissions by getting permissions with gcutil, editing, then I tried to update.

When I tried updating I used the following command

gsutil iam set permissions.txt gs://example.com/

But I got the following error

BadRequestException: 400 Role roles/CustomStorageObjectViewer is not supported for this resource.

Is there any way to configure a public gcp storage bucket without the storage.bucket.list permission?

Improve this question
4
  • The Q&A seems to be answered here
    – 030
    Commented Dec 24, 2019 at 14:57
  • I have the exact same question and I fail to see how the provided link provides an answer.
    – DavidM
    Commented Apr 7, 2020 at 17:36
  • @030 Any chance of reopening this question. I believe it was closed by mistake.
    – Kind Contributor
    Commented Apr 9, 2020 at 2:36
  • 1
    @Todd Q&A has been reopened.
    – 030
    Commented Apr 9, 2020 at 7:30

1 Answer 1

Reset to default
2

I am not entirely sure what configs you were using, but here is a process using CLI (gcloud and gsutil). The end product is a new custom role replacing the current standard roles/storage.objectViewer on allUsers for a GCP Bucket.

Recommend using GCP Cloud Cloud Shell in your Project: https://cloud.google.com/shell

  1. Create a new Role with the Custom Permissions you would like.

Create yaml file to hold the new config:

vi custom_role.yaml

Add role configurations to new custom_role.yaml:

title: "storageobjectviewer.nolist"
description: "Storage Object Viewer Role without source objects list"
stage: "ALPHA"
includedPermissions:
- resourcemanager.projects.get
- storage.objects.get

Create new Role in GCP:

gcloud iam roles create storageobjectviewer.nolist --project=[YOUR PROJECT] --file=custom_role.yaml
  1. Pull current permissions for [YOUR BUCKET] locally:

gsutil iam get gs://[YOUR BUCKET] > perms.txt

  1. Update Permissions with the new role.

Should only be this section:

{
  "members": [
    "allUsers"
  ],
  "role": "projects/[YOUR PROJECT]/roles/storageobjectviewer.nolist"
}
  1. Update the allUsers to the new role on [YOUR BUCKET]

gsutil iam set perms.txt gs://[YOUR BUCKET]

The new configuration should be viewable in CLI:

gsutil iam get gs://[YOUR BUCKET]

Also in the UI: Bucket Details -> Permissions enter image description here

and IAM -> Roles enter image description here Hopefully this helps!

Additional Info:

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.