Access to the Google Cloud Storage bucket

google-cloud-platform

I am trying to download a file into my bucket of my VM, but get the following error. How do I change the access to the access to the Google Cloud Storage bucket? The bucket was mounted using: gcsfuse user_bucket_1 my_bucket_2

This bucket was created when I have a different VM. Does it matter?
Edit: created a new bucket, same problem.

(base) user@instance-1:~/my_bucket_2$ gsutil -u absolute-bison-xxxx cp gs://realigned.cram.crai gs://bucket_1 

AccessDeniedException: 403 xxxxxxxxxxxxx-compute@developer.gserviceaccount.com does not have storage.objects.list access to the Google Cloud Storage bucket.

Best Answer

AccessDeniedException: 403 xxxxxxxxxxxxx-compute@developer.gserviceaccount.com does not have storage.objects.list access to the Google Cloud Storage bucket.

Looks Like the service account is creating that error. The reason why the service account is being automatically used, is because you are using the command from your GCE instance. It looks like the IAM role needs to be granted to service account : ‘xxxxxxxxxxxxx-compute@developer.gserviceaccount.com’

The service account requires "storage.objects.list" in the project of the bucket. Depending on your use case, you can grant roles/storage.objectAdmin or roles/storage.admin in the IAM Page. [Navigation Menu >> IAM & Admin] or with cloud shell. These roles also contain "storage.objects.list".

'gcloud auth login' to authenticate is a great idea as well, but adding the roles might be a little easier. It's your preference.

Related Solutions

Gsutil config for google-cloud-storage

gsutil will use the ~/.boto file. By default, gsutil will look for the configuration file in /etc/boto.cfg and ~/.boto.

If these files do not exist, it will use the legacy_credentials instead.

You can change all of this behavior by modifying the the BOTO_PATH and BOTO_CONFIG environment parameters.

Here is the documentation on how to use those environment variables.

BOTO_PATH: gsutil will load each configuration file found in the path in order. You may want to use this environment variable if you want to share a boto config amongst users. An example would be something like this :

BOTO_PATH=/etc/group/.boto.cfg:/home/user/.boto

BOTO_CONFIG: Use this variable to set the preference order. An example would be something like this :

BOTO_CONFIG=~/testa/.boto:~/testb/.boto .

This would put the preference on testa's boto file. If that is not there then gsutil would load the testb boto.

Any tool/command to check whether a Google Cloud Storage bucket is really inaccessible by public

As explained in the docs, you can do it with gsutil.

Something like :

gsutil acl get gs://«path-to-object»

From what I can read from your updated question, looking back to the same documentation I just linked up, you can see that the return means the following :

the project owners ALSO have ownership of the object,

the project editors ALSO have ownership of the object,

the project viewers ALSO have READ access to the object,

and the guy who first uploaded the object has ownership over it.

Best Answer

Related Solutions

Gsutil config for google-cloud-storage

Any tool/command to check whether a Google Cloud Storage bucket is really inaccessible by public

Related Topic