Google Cloud Storage: Grant User / Pass credentials per object

Question

I have a web application whose backend is deployed to Google Cloud Functions, and it uses Google Cloud Storage to store documents of end users. Users are authenticated to my application with Username and Password.

Is it possible to grant a specific read access to object on GCS for the object owner users, so that if User A owns document A on GCS, he's the only one to have access to it?

Thanks

Nope. I need per-object restrictions but ACLs (AFAIK) control access by Google account, not application-defined User & Password — Forepick
I don't think there is a mechanism for that. What you can do is remove access to all users and for each user generate SA. To each SA assign one GCS (this SA is the only account being able to access). For new users generate SA in the registration process — lukaszberwid
This sounds a bit too complicated. I was thinking remove access to all users except a single SA and then use a Cloud Function as an authentication service in front of the bucket. Can it work? — Forepick
Cloud Functions would also work. My approach seems like a lot of work, but that's just a few api calls and should be much easier to maintain that a Cloud Function working as a proxy. — lukaszberwid

lukaszberwid lukaszberwid · Accepted Answer · 2020-03-09T10:06:07

Cloud IAM Conditions might be exactly what you are looking for.

With Cloud IAM Conditions, you can choose to grant resource access to identities (members) only if configured conditions are met. For example, this could be done to configure temporary access for users in the event of a production issue or to limit access to resources only for employees making requests from your corporate office.

So for each member you can configure something like this:

"condition": {
    "title": Limit access to [Dedicated VM]
    "expression": "resource.type == "compute.googleapis.com/Instance" && resource.name == [Dedicated VM]"
}

There is a limit 20 rules per person, which shouldn't matter too much in this case.

Google Cloud Storage: Grant User / Pass credentials per object

2 Answers