8

I'm a project owner for a particular project, which has a bucket with a few hundred gigs of objects. I have recently discovered by a failed gcloud rsync that there are some objects in my bucket that I can list but not cp or acl get etc., neither from the commandline nor from the cloud console.

For example:

gsutil acl get gs://$MYBUCKET/$SOMEOBJECT  
AccessDeniedException: Access denied. Please ensure you have OWNER permission on gs://$MYBUCKET/$SOMEOBJECT  

I have

  • verified I'm authenticated as the right user (gcloud auth list)
  • verified that I'm in the roles/owners member section of the project (gcloud projects get-iam-policy $PROJECT_ID)
  • verified that the bucket belongs to the project (the entity "project-owners-$PROJECT_ID" has the projectNumber $PROJECT_ID and role OWNER).
  • The same problem occurs in the google cloud console, despite the fact that I'm the creator of the project

What on earth is going on?

0

4 Answers 4

9

Access to GCS resources is not recursive. Owning a project or a bucket within that project does not necessarily imply that you also have read access to some specific object. Owning the bucket does imply that you can list or delete the object, but that's it.

The owner of an object is always the user that uploaded it. By default, the ACLs on the object will align with the bucket's "default object ACL" setting, but the uploader can choose any other ACL during the upload.

5
  • I understand that bucket permissions are not recursive. What I don't understand is why I can't get at some of the contents of the bucket despite being a project owner. Should I not be able to access all resources within my project, including contents of gs buckets in the project, even if individual objects there where uploaded by say a service account I created? How do I fix this so I can set the ACL for the affected objects appropriately and then download them? What's the sudo chown equivalent here?
    – as.
    Oct 26, 2016 at 19:10
  • p.s. I'm pretty sure the incorrect ACL was not set during upload (or the service account) but later.
    – as.
    Oct 26, 2016 at 19:12
  • 1
    If you don't have read access to an object, there is currently no fix other than to have the owner of the object grant you access or else delete the object. I would suggest making a call as your service account to grant your user account read access. Oct 26, 2016 at 23:43
  • Thanks Brandon, using the service account works. I'm still genuinely perplexed by this. I believe that what happened is the following: the upload happened with default ACL by the service account, but that later someone set owner-only permission on some files from his user account. So unlike unix, it seems possible to lock yourself out of an object completely as admin by setting ACL on on object that wasn't created by yourself. What would happen in that case if someone goes and deletes the service account? Continue to pay, but lose all access?
    – as.
    Oct 28, 2016 at 11:35
  • 1
    Yes, that is exactly what would happen. As the owner of the bucket, you could still delete the object at any time, but you wouldn't be able to read it. The only user who can't have their access to their object removed is the original uploader. Oct 28, 2016 at 15:56
3

You can set Cloud IAM policy to project or bucket.

For example, if you are a project owner and you want to full access of all buckets in the project, follow the steps below.

  1. Open IAM management
  2. Click Edit permissions icon associated with the user which you want to add Cloud IAM policy
  3. Add [Storage]-[Storage Admin] role. not [Storage Legacy].
  4. Click Save button

Then you are granted full access to the object even if you are not the owner of the object.

0

I've solved my similar problem using IAM, like this:

    gsutil iam ch 'user:[email protected]:legacyObjectOwner' gs://mybucket

After that, the user has owner rights.

1
0

I struggled with a similar situation: A service account that created an object was listed as OWNER (with gsutil acl get gs://...) but failed to set ACL. Then I found the following quote in https://cloud.google.com/storage/docs/access-control/lists#predefined-acl:

You cannot apply ACLs that change the ownership of a bucket or object (which should not be confused with the OWNER permission)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .