> For the complete documentation index, see [llms.txt](https://docs.omics.ai/products/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.omics.ai/products/publisher/data-sources/connectors/google-cloud-storage-gcs-permissions.md).

# Google Cloud Storage (GCS) Permissions

Configuring Google Cloud Storage (GCS) permissions establishes secure access between [Publisher](https://github.com/DNAstack/dnastack-product-docs/tree/main/docs/publisher/data-sources/connectors/broken-reference/README.md) and your cloud storage resources. These permissions define how Publisher can interact with your buckets and objects, using service accounts and custom roles to ensure controlled access.

This guide outlines the minimum permissions needed to connect Publisher to specific GCS resources, including credential creation and bucket-level access configuration.

## Concepts

* **Service Account (SA):** This is an identity generated in Google Cloud that can be used to interact with GCP services. Each SA has a unique email (identity) and one or more JSON keys.
* **Data Project**: A project that houses the target bucket(s).
* **Permission**: Granular actions that a user can perform on a given resource.
* **Role:** A collection of permissions typically needed for specific interactions against one or more resources: “Data Viewer,” “Storage Reader,” etc.

## Minimal Configuration

{% hint style="info" %}
This setup represents the minimal permissions needed to connect Publisher to a **SPECIFIC** set of GCS buckets using only predefined roles — no custom roles are required. All grants are made within the Data Project that houses the buckets.
{% endhint %}

### Creating Credentials

Create a new Service Account (SA) in any project.

{% hint style="info" %}
For more information on creating a new service account within GCS, please refer to Google's [IAM Guide](https://cloud.google.com/iam/docs/service-accounts-create).
{% endhint %}

```
gcloud iam service-accounts create publisher-connectors \
    --project=${PROJECT} \
    --display-name="Publisher Data Connections"
```

Generate a new JSON key and download it.

```
gcloud iam service-accounts keys create \
  publisher-connectors-key.json \
--iam-account=publisher-connectors@${PROJECT}.iam.gserviceaccount.com
```

### Granting Bucket List Access in Data Project

Publisher needs permission to list the buckets in the Data Project. Google Cloud now provides the **Storage Bucket Viewer** (`roles/storage.bucketViewer`) predefined role, which grants exactly the `storage.buckets.list` and `storage.buckets.get` permissions Publisher requires.

{% hint style="info" %}
Previously this step required creating a custom "Storage Bucket Lister" role. That custom role is no longer necessary — assign the predefined `roles/storage.bucketViewer` role instead.
{% endhint %}

Assign the predefined role to the SA you created in "Creating Credentials":

```
gcloud projects add-iam-policy-binding ${PROJECT} \ 
--member="serviceAccount:publisher-connectors@${PROJECT}.iam.gserviceaccount.com" \
--role="roles/storage.bucketViewer"
```

### Data Project

For each bucket that you want to connect to Publisher, assign the **Storage Object Viewer** policy to the service account:

```
gcloud storage buckets add-iam-policy-binding gs://${BUCKET} \
--member="serviceAccount:publisher-connectors@${PROJECT}.iam.gserviceaccount.com" \
--role=roles/storage.objectViewer \
--project=${PROJECT}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.omics.ai/products/publisher/data-sources/connectors/google-cloud-storage-gcs-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.