Skip to content

IAM permissions

The following page discusses the Identity and Access Management (IAM) permissions required to perform actions within the Cloud Storage portion of the Google Cloud console. IAM permissions are bundled together to make roles, and you grant roles to users and groups. See the Google documentation on IAM Roles for more information.

Granting permissions

Certain permissions are necessary to use the Google Cloud console:

To grant Cloud Access Management the required permissions to your organization:

  1. Go to IAM & Admin > Roles.
  2. Select + CREATE ROLE.
  3. Enter a title, description, and a unique ID.
  4. Select + ADD PERMISSIONS and add the following permissions:
orgpolicy.policy.get
resourcemanager.projects.get
secretmanager.versions.access
storage.buckets.get
storage.multipartUploads.abort
storage.multipartUploads.create
storage.multipartUploads.list
storage.multipartUploads.listParts
storage.objects.create
storage.objects.delete
storage.objects.get
storage.objects.list
storage.objects.update
  1. Select CREATE to create the role with these permissions.
  2. Select IAM & Admin > IAM.
  3. Select ADD.
  4. Search for or paste the service account email in New principals.
  5. Select the newly created role in the dropdown menu and select SAVE.