I have a seemingly easy question regarding IAM users, roles and bucket access in Google Cloud Platform.

I have 2 users U1 and U2 defined in a project. They are both in role R1. I have a bucket S1 that I want to give both users read access to, via UI or Console. I don't want to give storage.reader (full read access to all buckets) to either the users or the role.

My ideal would be to grant role R1 access to the bucket. However, the UI only allows adding users, not roles. Also, all the documentation at https://cloud.google.com/storage/docs/gsutil/commands/acl and https://cloud.google.com/storage/docs/access-control/lists#permissions refers to users only, and not IAM roles.

Is there a way via UI or console to grant an IAM role access to a storage bucket, so that all users in that role have consistent permissions? Adding individual users to a bucket doesn't scale, though we could deal with it programmatically if necessary.

Alternately, am I thinking about IAM Roles wrong? Being an AWS person, this could certainly be the case...

1 Answer 1


I think you are confused about how Roles work in GCP. One role in GCP is a collection of permissions since those permissions cannot be assigned directly to an identity (user, group or service account).

Now, regarding your question and referring to the documentation mentioned above, in this link are described the roles that you can use for your users depending on the task that you want to allow them to perform within the storage bucket.

Also, here you can find a good reference on how to use those roles.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.