Google Cloud Storage: With "Bucket Policy Only", how do I make objects public but prevent listing?

Question

I just tried the new "Bucket Policy Only" setting in a preexisting test bucket. I want to be able to anonymously download objects by URL, but prevent the public from listing objects in the bucket.

If I add the Storage Object Viewer role to allUsers, then the public can both list the bucket and download objects. If I don't add that role, the public can't download files.

What's the trick? I have this working fine with the old ACL system.

Answer 1

It seems to work the way I want if I use the role Storage Legacy Object Reader.

It does seem odd to use something called "Legacy" for such a basic use case.