Search code examples
google-cloud-platformterraformgoogle-cloud-storageterraform-provider-gcp

Custom role to allow download files and disable upload files in GCS bucket

I'd like to create a custom role that only allow a group email to list and download the files. However, they're NOT ALLOWED to upload any files in specific bucket.

Which role should I use to create the custom role?

Solution

  • you can use the predefined role Storage Object Viewer for your use case, which has the following permissions:

    resourcemanager.projects.get
resourcemanager.projects.list
storage.objects.get
Storage.objects.list

    Since we already have a predefined role, you will not be required to create a custom role. If this doesn’t meet your requirements then please explain the question in detail.

    If you have created a google group with the email addresses, then you might wanna look at this link.