Cloud IAM permissions for JSON methods

The following table lists the Cloud Identity and Access Management (Cloud IAM) permissions required to run each Cloud Storage JSON method on a given resource.

Resource	Method	Required Cloud IAM Permissions¹
`BucketAccessControls`	`delete`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`BucketAccessControls`	`get`	`storage.buckets.get`
`BucketAccessControls`	`get`	`storage.buckets.getIamPolicy`
`BucketAccessControls`	`insert`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`BucketAccessControls`	`list`	`storage.buckets.get`
`BucketAccessControls`	`list`	`storage.buckets.getIamPolicy`
`BucketAccessControls`	`patch`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`BucketAccessControls`	`update`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`Buckets`	`delete`	`storage.buckets.delete`
`Buckets`	`get`	`storage.buckets.get`
`Buckets`	`get`	`storage.buckets.getIamPolicy`²
`Buckets`	`getIamPolicy`	`storage.buckets.getIamPolicy`
`Buckets`	`insert`	`storage.buckets.create`
`Buckets`	`list`	`storage.buckets.list`
`Buckets`	`list`	`storage.buckets.getIamPolicy`²
`Buckets`	`lockRetentionPolicy`	`storage.buckets.update`
`Buckets`	`patch`	`storage.buckets.update`
		`storage.buckets.getIamPolicy`³
		`storage.buckets.setIamPolicy`⁵
`Buckets`	`setIamPolicy`	`storage.buckets.setIamPolicy`
`Buckets`	`testIamPermissions`	None
`Buckets`	`update`	`storage.buckets.setIamPolicy`
`Buckets`	`update`	`storage.buckets.update`
`Channels`	`stop`	None
`DefaultObjectAccessControls`	`delete`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`DefaultObjectAccessControls`	`get`	`storage.buckets.get`
`DefaultObjectAccessControls`	`get`	`storage.buckets.getIamPolicy`
`DefaultObjectAccessControls`	`insert`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`DefaultObjectAccessControls`	`list`	`storage.buckets.get`
`DefaultObjectAccessControls`	`list`	`storage.buckets.getIamPolicy`
`DefaultObjectAccessControls`	`patch`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`DefaultObjectAccessControls`	`update`	`storage.buckets.get`
		`storage.buckets.getIamPolicy`
		`storage.buckets.setIamPolicy`
		`storage.buckets.update`
`Notifications`	`delete`	`storage.buckets.update`
`Notifications`	`get`	`storage.buckets.get`
`Notifications`	`insert`	`storage.buckets.update`
`Notifications`	`list`	`storage.buckets.get`
`ObjectAccessControls`	`delete`	`storage.objects.get`
		`storage.objects.getIamPolicy`⁶
		`storage.objects.setIamPolicy`⁶
		`storage.objects.update`
`ObjectAccessControls`	`get`	`storage.objects.get`
`ObjectAccessControls`	`get`	`storage.objects.getIamPolicy`⁶
`ObjectAccessControls`	`insert`	`storage.objects.get`
		`storage.objects.getIamPolicy`⁶
		`storage.objects.setIamPolicy`⁶
		`storage.objects.update`
`ObjectAccessControls`	`list`	`storage.objects.get`
`ObjectAccessControls`	`list`	`storage.objects.getIamPolicy`⁶
`ObjectAccessControls`	`patch`	`storage.objects.get`
		`storage.objects.getIamPolicy`⁶
		`storage.objects.setIamPolicy`⁶
		`storage.objects.update`
`ObjectAccessControls`	`update`	`storage.objects.get`
		`storage.objects.getIamPolicy`⁶
		`storage.objects.setIamPolicy`⁶
		`storage.objects.update`
`Objects`	`compose`	`storage.objects.create`
		`storage.objects.delete⁴`
		`storage.objects.get`
`Objects`	`copy`	`storage.objects.create` (for the destination bucket)
		`storage.objects.delete` (for the destination bucket)⁴
		`storage.objects.get` (for the source bucket)
`Objects`	`delete`	`storage.objects.delete`
`Objects`	`get`	`storage.objects.get`
`Objects`	`get`	`storage.objects.getIamPolicy`²^,6
`Objects`	`insert`	`storage.objects.create`
`Objects`	`insert`	`storage.objects.delete`⁴
`Objects`	`list`	`storage.objects.list`
`Objects`	`list`	`storage.objects.getIamPolicy`²^,6
`Objects`	`patch`	`storage.objects.get`
		`storage.objects.getIamPolicy`⁶
		`storage.objects.update`
		`storage.objects.setIamPolicy`³^,6
`Objects`	`rewrite`	`storage.objects.create` (for the destination bucket)
		`storage.objects.delete` (for the destination bucket)⁴
		`storage.objects.get` (for the source bucket)
`Objects`	`update`	`storage.objects.setIamPolicy`⁶
`Objects`	`update`	`storage.objects.update`
`Objects`	`watchAll`	`storage.buckets.update`
`Projects.serviceAccount`	`get`	`resourceManager.projects.get`

¹ If you use the userProject parameter or the x-goog-user-project header in your request, you must have serviceusage.services.use permission for the project ID that you specify, in addition to the normal Cloud IAM permissions required to make the request.

² This permission is only required if you want to include ACLs or Cloud IAM policies as part of a full projection. If you don't have this permission and request a full projection, you receive only a partial projection.

³ This permission is only required if you want to include ACLs or Cloud IAM policies as part of the response.

⁴ This permission is only required when the inserted object has the same name as an object that already exists in the bucket.

⁵ This permission is required if you want to include ACLs or Cloud IAM policies as part of the request.

⁶ This permission does not apply to buckets with Bucket Policy Only enabled.

What's next

For a list of roles and the permissions they contain, see Cloud IAM Roles for Cloud Storage.

Was this page helpful? Let us know how we did:

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see our Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated June 5, 2019.

Jun	JUL	Aug
	16
2018	2019	2020

Cloud IAM permissions for JSON methods

What's next

Send feedback about...