IAM roles for Cloud Storage
This document provides information about Identity and Access Management (IAM) roles andpermissions for Cloud Storage.
Predefined roles
The following table describesIdentity and Access Management (IAM) rolesthat are associated with Cloud Storage and lists thepermissions that are contained in each role. Unless otherwise noted, these rolescan be applied either to projects, buckets, or managed folders. However, you cangrant legacy roles only to individual buckets.
To learn how to control access to buckets, seeuse IAM permissions. To learn how to control access tomanaged folders, seeuse IAM for managed folders.
| Role | Permissions |
|---|---|
Storage Admin( Grants full control of objects and buckets. When applied to an individualbucket, control applies only tothe specified bucket and objects within the bucket. Lowest-level resources where you can grant this role:
|
|
Storage Bucket ViewerBeta( Grants permission to view buckets and their metadata, excluding IAM policies. |
|
Storage Express Mode Service InputBeta( Grants permission to Express Mode service accounts at a managed folder so they can create objects but not read them on input folders. |
|
Storage Express Mode Service OutputBeta( Grants permission to EasyGCP service accounts at a managed folder so they can read objects but not write them on output folders. |
|
Storage Express Mode User AccessBeta( Grants permission to Express Mode accounts at the project level so they can read, list, create and delete any object in any of their buckets in Express Mode. |
|
Storage Folder Admin( Grants full control over folders and objects, including listing, creating, viewing, and deleting objects. |
|
Storage HMAC Key Admin( Full control of Cloud Storage HMAC keys. |
|
Storage Insights Collector Service( Read-only access to Cloud Storage Inventory metadata for Storage Insights. |
|
Storage Legacy Bucket Owner( Grants permission to create, overwrite, and delete objects; list objectsin a bucket and read object metadata, excluding allow policies, whenlisting; and read and edit bucket metadata, including allow policies. Use of this role is also reflected in the bucket's ACLs. For moreinformation, seeIAM relation to ACLs. Lowest-level resources where you can grant this role:
|
|
Storage Legacy Bucket Reader( Grants permission to list a bucket's contents and read bucket metadata,excluding allow policies. Also grants permission to read object metadata,excluding allow policies, when listing objects. Use of this role is also reflected in the bucket's ACLs. For moreinformation, seeIAM relation to ACLs. Lowest-level resources where you can grant this role:
|
|
Storage Legacy Bucket Writer( Grants permission to create, overwrite, and delete objects; list objectsin a bucket and read object metadata, excluding allow policies, whenlisting; and read bucket metadata, excluding allow policies. Use of this role is also reflected in the bucket's ACLs. For moreinformation, seeIAM relation to ACLs. Lowest-level resources where you can grant this role:
|
|
Storage Legacy Object Owner( Grants permission to view and edit objects and their metadata, includingACLs. Lowest-level resources where you can grant this role:
|
|
Storage Legacy Object Reader( Grants permission to view objects and their metadata, excluding ACLs. Lowest-level resources where you can grant this role:
|
|
Storage Object Admin( Grants full control of objects, including listing, creating, viewing,and deleting objects. Lowest-level resources where you can grant this role:
|
|
Storage Object Creator( Allows users to create objects. Does not give permission to view,delete, or overwrite objects. Lowest-level resources where you can grant this role:
|
|
Storage Object User( Access to create, read, update and delete objects and multipart uploads in GCS. |
|
Storage Object Viewer( Grants access to view objects and their metadata, excluding ACLs. Canalso list the objects in a bucket. Lowest-level resources where you can grant this role:
|
|
- The
orgpolicy.policy.getpermission allows principalsto know theorganization policy constraints that a project is subject to.This permission is only effective if the role isgranted at the project level or above. - For more information about the
resourcemanager.projects.*permissions, seeAccess control for projects with IAM. - The
storagebatchoperations.jobs.*andstoragebatchoperations.operations.*permissions allow you tocreate and manage storage batch operations jobs.These permissions are effective only if the role isgranted at the project level.
Predefined Storage Insights roles
The following table describesIAM rolesthat are associated with Storage Insights and lists thepermissions that are contained in each role.
| Role | Permissions |
|---|---|
Storage Insights Admin( Full access to Storage Insights resources. |
|
Storage Insights Analyst( Data access to Storage Insights. |
|
StorageInsights Service Agent( Permissions for Insights to write reports into customer project Warning: Do not grant service agent roles to any principals exceptservice agents. |
|
Storage Insights Viewer( Read-only access to Storage Insights resources. |
|
Basic roles
Note: You should minimize the use of basic roles if possible, and in productionenvironments, don't grant basic roles unless there is no alternative. Basicroles contain a wide range of permissions across all Google Cloud servicesand have potentially surprising behavior in Cloud Storage as describedin this section.Basic roles are roles that existed prior to IAM. These roles haveunique characteristics:
Basic roles can only be granted for an entire project, not for individualbuckets within the project. Like other roles that you grant for a project,basic roles apply to all buckets and objects in the project.
Basic roles contain additional permissions for other Google Cloudservices that are not covered in this section. Seebasic roles for ageneral discussion of the permissions that basic roles grant.
Each basic role has aconvenience value that lets you use the basicrole as if it were a group. When used in this way, any principal that has thebasic role is considered to be part of the group. Everyone in the group getsadditional access for resources based on the access the convenience value has.
Convenience values can be used when granting roles for buckets.
Convenience values can be used when setting ACLs on objects.
Basic roles don't intrinsically give all of the access toCloud Storage resources that their names imply. Instead, they givea portion of the expected access intrinsically and the rest of the expectedaccess through the use of convenience values. Because convenience values canbe manually added or removed like any other IAM principal, itis possible to revoke access that principals might otherwise expect to have.
For a discussion of additional access that principals with basic rolestypically gain due to convenience values, seemodifiable behavior.
Intrinsic permissions
The following table describes the Cloud Storage permissions that arealways associated with each basic role.
| Role | Description | Cloud Storage Permissions |
|---|---|---|
Viewer (roles/viewer) | Grants permission to list buckets in the project; view bucket metadata when listing (excluding ACLs); and list and get HMAC keys in the project. | storage.buckets.getIpFilterstorage.buckets.liststorage.hmacKeys.getstorage.hmacKeys.list |
Editor (roles/editor) | Grants permission to create, list, and delete buckets in the project; view bucket metadata when listing (excluding ACLs); and control HMAC keys in the project. | storage.buckets.createstorage.buckets.deletestorage.buckets.getIpFilterstorage.buckets.liststorage.hmacKeys.* |
Owner (roles/owner) | Grants permission to create, list, and delete buckets in the project; view bucket metadata when listing (excluding ACLs); create, delete, and list tag bindings; and control HMAC keys in the project; Enable, disable, update, and get the Storage Intelligence configuration on a project, a folder, or an organization. Within Google Cloud more generally, principals with this role can perform administrative tasks such as changing principals' roles for the project or changing billing. | storage.buckets.createstorage.buckets.deletestorage.buckets.liststorage.buckets.createTagBindingstorage.buckets.deleteTagBindingstorage.buckets.getIpFilterstorage.buckets.listEffectiveTagsstorage.buckets.listTagBindingsstorage.buckets.setIpFilterstorage.hmacKeys.*storage.intelligenceConfigs.getstorage.intelligenceConfigs.update |
Modifiable behavior
Principals granted basic roles often have additional access to a project'sbuckets and objects due toconvenience values. When a bucket is created,convenience values are granted certain bucket-level access, but you can lateredit your bucket IAM policies and your object ACLs to remove orchange the access.
When you create a bucket that hasuniform bucket-level access enabled, thefollowing access is granted via convenience values:
Principals granted
roles/viewergain theroles/storage.legacyBucketReaderandroles/storage.legacyObjectReaderroles for the bucket.Principals granted
roles/editorgain theroles/storage.legacyBucketOwnerandroles/storage.legacyObjectOwnerroles for the bucket.Principals granted
roles/ownergain theroles/storage.legacyBucketOwnerandroles/storage.legacyObjectOwnerroles for the bucket.
When you create a bucket that does not have uniform bucket-level access enabled, thefollowing access is granted using convenience values:
Principals granted
roles/viewergain theroles/storage.legacyBucketReaderrole for the bucket.Principals granted
roles/editorgain theroles/storage.legacyBucketOwnerrole for the bucket.Principals granted
roles/ownergain theroles/storage.legacyBucketOwnerrole for the bucket.Additionally, the bucket has adefault object Access Control List (ACL).This default ACL is often applied to new objects in the bucket and oftengrants additional access to convenience values.
Custom roles
You might want to define your own roles which contain bundles of permissions thatyou specify. To support this, IAM offerscustom roles.
What's next
Use IAM permissions to control access to buckets andobjects.
Learn about eachIAM permission for Cloud Storage.
See availableIAM references for Cloud Storage,such as which IAM permissions allow users to perform actionswith various tools and APIs.
For a reference of other Google Cloud roles, seeUnderstanding Roles.
Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-02-19 UTC.