A colleague of mine has created a google cloud platform project for which we would like to use the Cloud Storage product. They have made me co-owner and storage admin in the IAM permissions. According to the google docs a storage admin has storage.objects.* permissions so I should be able to get bucket objects.

I wrote a simple python script to download some content as follows (pseudocode only):

storage_client = storage.Client()
bucket = storage_client.bucket(BUCKET_NAME)
blob = bucket.blob(source_blob_name)

However, the last line throws an error:

google.api_core.exceptions.Forbidden: 403 GET does not have storage.objects.get access to the Google Cloud Storage object.

I've checked my permissions again and again in the cloud console, and also made sure that my GOOGLE_APPLICATION_CREDENTIALS environment variable is defined. Why is GCP refusing me access to this bucket and how can I fix this?

  • Because the service account defined by GOOGLE_APPLICATION_CREDENTIALS does not have the required role. Jun 14 at 20:56

Here the permission granted to the service account got applied not the permission given to you.

We create a JSON key using the service account and give the path of the key to GOOGLE_APPLICATION_CREDENTIALS.

I guess may be the service account got deleted or the service account doesn't have proper permission.

May be you can try re creating service account and JSON key from it and give proper permission to it.

docs for reference.

NOTE : In the docs owner role given to service account which gives more permission than required to service account. You can change the role according to your need.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.