To run Cloud Storage [MCP server methods](https://docs.cloud.google.com/storage/docs/use-cloud-storage-mcp.md.txt), you need access to the target
Cloud Storage resources. You manage access control by granting
Identity and Access Management (IAM) roles to principals, such as users, groups, and
service accounts. Each role contains a set of permissions. If you want to
create custom roles with specific permissions, this document lists the
permissions that are required for each MCP server method.

| Method | Required IAM permissions |
|---|---|
| `create_bucket` | `mcp.tools.call` `storage.buckets.create` |
| `delete_bucket` | `mcp.tools.call` `storage.buckets.delete` |
| `delete_object` | `mcp.tools.call` `storage.objects.delete` |
| `get_bucket_metadata` | `mcp.tools.call` `storage.buckets.get` |
| `get_object_metadata` | `mcp.tools.call` `storage.objects.get` |
| `list_buckets` | `mcp.tools.call` `storage.buckets.list` |
| `list_objects` | `mcp.tools.call` `storage.objects.list` |
| `read_object` | `mcp.tools.call` `storage.objects.get` |
| `write_text` | `mcp.tools.call` `storage.objects.create` |

## What's next

- Learn about [IAM for Cloud Storage](https://docs.cloud.google.com/storage/docs/access-control/iam.md.txt).

- For a list of predefined roles and the permissions that they contain, see
  [IAM roles for Cloud Storage](https://docs.cloud.google.com/storage/docs/access-control/iam-roles.md.txt).

- [Grant IAM roles](https://docs.cloud.google.com/storage/docs/access-control/using-iam-permissions.md.txt) at the project and bucket level.