{"id":7276,"date":"2026-09-20T17:22:55","date_gmt":"2026-09-20T17:22:55","guid":{"rendered":"https:\/\/prwatech.in\/blog\/?p=7276"},"modified":"2026-09-21T15:14:52","modified_gmt":"2026-09-21T15:14:52","slug":"functions-in-bucket","status":"publish","type":"post","link":"https:\/\/prwatech.in\/blog\/google-cloud-platform\/cloud-storage\/functions-in-bucket\/","title":{"rendered":"Permissions used in bucket"},"content":{"rendered":"\r\n

Cloud Storage Bucket Permissions<\/h1>\r\n

Cloud Storage controls who can view, add, or manage objects in a bucket through two separate systems. IAM roles grant access at the bucket or project level, while Fine Grained access control additionally allows setting a permission on one specific object rather than the whole bucket. Which system you can use depends on the bucket’s access control setting, and that setting is not always something you can undo.<\/p>\r\n

This walks through granting a role at the bucket level, setting an individual permission on a single object under Fine Grained access, and switching a bucket over to Uniform access control.<\/p>\r\n

Step by Step Process for Creating Cloud Storage Bucket Permissions<\/h2>\r\n

Step One: Open the Bucket Browser<\/h3>\r\n

Open the console, then<\/p>\r\n\r\n\r\n\r\n

Click Menu > Cloud Storage > Browser<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Step Two: Select a Project<\/h3>\r\n\r\n\r\n\r\n
\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Step Three: Open the Bucket’s Configuration<\/h3>\r\n

Click Configuration to see the bucket’s current settings.<\/p>\r\n\r\n\r\n\r\n

\"\"<\/figure>\r\n\r\n\r\n\r\n

Step Four: Open Permissions<\/h3>\r\n

Click Permissions. The Access Control setting shown here, Fine Grained in this example, decides whether individual objects can carry their own separate permissions or not. Click Add to grant a new permission.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Step Five: Grant a Role at the Bucket Level<\/h3>\r\n

Enter the member’s email address, service account, or Google Workspace group.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Select the role from the list. You can assign multiple roles for single member.<\/p>\r\n\r\n\r\n\r\n

\"\"<\/figure>\r\n\r\n\r\n\r\n

Click Save.<\/p>\r\n\r\n\r\n\r\n

\"\"<\/figure>\r\n

Step Six: Open Objects<\/h3>\r\n

Click Objects to see the files and folders already uploaded to the bucket.<\/p>\r\n\r\n\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Step Seven: Set a Permission on a Single File<\/h3>\r\n

Click the three dots next to a file, then Edit Permissions. Under Fine Grained access, each object can carry its own separate permissions, independent of the bucket level roles set earlier.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Here we can give individual permission for individual file. It is done because the access control is fine grained.<\/p>\r\n\r\n\r\n\r\n

We are giving individual permission for doc-1. Click on Add Entry.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Select the Entity type for your needs. Give the mail-id\/ G-suite\/ service account.<\/p>\r\n\r\n\r\n\r\n

Select the Access type you need to give. Click Save.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Step Eight: Switch to Uniform Access Control<\/h3>\r\n\r\n\r\n\r\n

Click on Permissions > Switch to uniform.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Select Uniform and click Save. This applies the same set of permissions to every object in the bucket, and object level permissions set individually under Fine Grained no longer apply.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Click on Add.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Give the member(s) mail-ID\/ G-suite\/ Service account.<\/p>\r\n\r\n\r\n\r\n

Select the role which you want to assign. Click Save.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n<\/div>\r\n\r\n\r\n\r\n

Now the member will have the uniform access to bucket.<\/p>\r\n\r\n\r\n\r\n

\r\n
\"\"<\/figure>\r\n

Fine Grained Versus Uniform, and the One Way Switch<\/h2>\r\n

Fine Grained access is Cloud Storage’s legacy access system, letting you set a permission on one object independently of the bucket as a whole. Uniform access control does away with that, applying IAM roles consistently to every object in the bucket, with no per object exceptions. New buckets default to Uniform today, and Google’s own guidance recommends it for most use cases, since it is simpler to audit and keeps a bucket from having quietly inconsistent permissions scattered across individual files.<\/p>\r\n

The part worth knowing before you switch: once Uniform access has been active on a bucket for 90 consecutive days, it cannot be switched back to Fine Grained. If you are testing this on a bucket you might need object level permissions on again later, be aware that the option to switch back closes permanently after that window.<\/p>\r\n

Choosing the Right Role<\/h2>\r\n