2
votes

In our project, we have a group of people which should have full access to ONLY a bucket and they should not see other buckets or the object on the other buckets. so, i changed the permission of the bucket, and i added the users as Storage Admin for that specific bucket (not for whole project).

In this case, when they use console/Storage they see the following message: enter image description here

But when they open cloud Shell and they use Gsutil, they can access to the bucket objects (no access to other buckets).

Is this a bug on the interface of Console/storage?

1

1 Answers

4
votes

This is not a bug, but it is a subtlety of the Console. In order to access a bucket from the Console, you typically navigate to it using the Browser, which is what appears you attempt in the screenshot. This fails, though, because to do this you need permission to list buckets for a project, even if you otherwise have free reign to work within the bucket.

There are three ways to deal with this:

1) Give your users the Viewer permission for the project that contains the bucket. There are pros and cons to this. I'd say it's probably not worth going this route (though not as much because your users will see other buckets - bucket namespace is publicly viewable anyway - but because doing so brings up some additional permission nuances you probably don't want to deal with).

2) Link directly to the desired bucket, thus avoiding the "listing buckets" portion of the Console. The URL for a bucket has the form: console.cloud.google.com/storage/browser/[BUCKET_NAME]. I believe this will work without any additional modifications to your permissions.

3) Create a custom role that only contains the storage.buckets.list permission, and use that role on the project for affected users.