I have a seemingly easy question regarding IAM users, roles and bucket access in Google Cloud Platform.
I have 2 users U1 and U2 defined in a project. They are both in role R1. I have a bucket S1 that I want to give both users read access to, via UI or Console. I don't want to give storage.reader (full read access to all buckets) to either the users or the role.
My ideal would be to grant role R1 access to the bucket. However, the UI only allows adding users, not roles. Also, all the documentation at https://cloud.google.com/storage/docs/gsutil/commands/acl and https://cloud.google.com/storage/docs/access-control/lists#permissions refers to users only, and not IAM roles.
Is there a way via UI or console to grant an IAM role access to a storage bucket, so that all users in that role have consistent permissions? Adding individual users to a bucket doesn't scale, though we could deal with it programmatically if necessary.
Alternately, am I thinking about IAM Roles wrong? Being an AWS person, this could certainly be the case...