2

Google Cloud Platform Storage Buckets can be directly exposed via HTTP. The recommended configuration for this is to have allUsers with the Storage Object Viewer role.

The Storage Object Viewer role has got storage.bucket.list permission. I tried creating a custom role based on this role and removed the storage.bucket.list permission.

I updated the IAM permissions by getting permissions with gcutil, editing, then I tried to update.

When I tried updating I used the following command

gsutil iam set permissions.txt gs://example.com/

But I got the following error

BadRequestException: 400 Role roles/CustomStorageObjectViewer is not supported for this resource.

Is there any way to configure a public gcp storage bucket without the storage.bucket.list permission?

4
  • The Q&A seems to be answered here – 030 Dec 24 '19 at 14:57
  • I have the exact same question and I fail to see how the provided link provides an answer. – DavidM Apr 7 '20 at 17:36
  • @030 Any chance of reopening this question. I believe it was closed by mistake. – Todd Apr 9 '20 at 2:36
  • 1
    @Todd Q&A has been reopened. – 030 Apr 9 '20 at 7:30
2

I am not entirely sure what configs you were using, but here is a process using CLI (gcloud and gsutil). The end product is a new custom role replacing the current standard roles/storage.objectViewer on allUsers for a GCP Bucket.

Recommend using GCP Cloud Cloud Shell in your Project: https://cloud.google.com/shell

  1. Create a new Role with the Custom Permissions you would like.

Create yaml file to hold the new config:

vi custom_role.yaml

Add role configurations to new custom_role.yaml:

title: "storageobjectviewer.nolist"
description: "Storage Object Viewer Role without source objects list"
stage: "ALPHA"
includedPermissions:
- resourcemanager.projects.get
- storage.objects.get

Create new Role in GCP:

gcloud iam roles create storageobjectviewer.nolist --project=[YOUR PROJECT] --file=custom_role.yaml
  1. Pull current permissions for [YOUR BUCKET] locally:

gsutil iam get gs://[YOUR BUCKET] > perms.txt

  1. Update Permissions with the new role.

Should only be this section:

{
  "members": [
    "allUsers"
  ],
  "role": "projects/[YOUR PROJECT]/roles/storageobjectviewer.nolist"
}
  1. Update the allUsers to the new role on [YOUR BUCKET]

gsutil iam set perms.txt gs://[YOUR BUCKET]

The new configuration should be viewable in CLI:

gsutil iam get gs://[YOUR BUCKET]

Also in the UI: Bucket Details -> Permissions enter image description here

and IAM -> Roles enter image description here Hopefully this helps!

Additional Info:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.