Google Cloud Storage (GCS) Permissions

Configuring Google Cloud Storage (GCS) permissions establishes secure access between Publisher and your cloud storage resources. These permissions define how Publisher can interact with your buckets and objects, using service accounts and custom roles to ensure controlled access.

This guide outlines the minimum permissions needed to connect Publisher to specific GCS resources, including credential creation and bucket-level access configuration.

Concepts

• Service Account (SA): This is an identity generated in Google Cloud that can be used to interact with GCP services. Each SA has a unique email (identity) and one or more JSON keys.

• Data Project: A project that houses the target bucket(s).

• Permission: Granular actions that a user can perform on a given resource.

• Role: A collection of permissions typically needed for specific interactions against one or more resources: “Data Viewer,” “Storage Reader,” etc.

Minimal Configuration

This setup represents the minimal permissions needed to connect Publisher to a SPECIFIC set of GCS buckets using only predefined roles — no custom roles are required. All grants are made within the Data Project that houses the buckets.

Creating Credentials

Create a new Service Account (SA) in any project.

For more information on creating a new service account within GCS, please refer to Google's IAM Guide.

gcloud iam service-accounts create publisher-connectors \
    --project=${PROJECT} \
    --display-name="Publisher Data Connections"

Generate a new JSON key and download it.

gcloud iam service-accounts keys create \
  publisher-connectors-key.json \
--iam-account=publisher-connectors@${PROJECT}.iam.gserviceaccount.com

Granting Bucket List Access in Data Project

Publisher needs permission to list the buckets in the Data Project. Google Cloud now provides the Storage Bucket Viewer (roles/storage.bucketViewer) predefined role, which grants exactly the storage.buckets.list and storage.buckets.get permissions Publisher requires.

Previously this step required creating a custom "Storage Bucket Lister" role. That custom role is no longer necessary — assign the predefined roles/storage.bucketViewer role instead.

Assign the predefined role to the SA you created in "Creating Credentials":

gcloud projects add-iam-policy-binding ${PROJECT} \ 
--member="serviceAccount:publisher-connectors@${PROJECT}.iam.gserviceaccount.com" \
--role="roles/storage.bucketViewer"

Data Project

For each bucket that you want to connect to Publisher, assign the Storage Object Viewer policy to the service account:

gcloud storage buckets add-iam-policy-binding gs://${BUCKET} \
--member="serviceAccount:publisher-connectors@${PROJECT}.iam.gserviceaccount.com" \
--role=roles/storage.objectViewer \
--project=${PROJECT}