Ruoli IAM per Cloud Storage

Questo documento fornisce informazioni sui ruoli e sulle autorizzazioni di Identity and Access Management (IAM) per Cloud Storage.

Ruoli predefiniti

La tabella seguente descrive i ruoli Identity and Access Management (IAM) associati a Cloud Storage ed elenca le autorizzazioni contenute in ciascun ruolo. Salvo diversa indicazione, questi ruoli possono essere applicati a progetti, bucket o cartelle gestite. Tuttavia, puoi concedere i ruoli legacy solo a singoli bucket.

Per scoprire come controllare l'accesso ai bucket, consulta Utilizzare le autorizzazioni IAM. Per scoprire come controllare l'accesso alle cartelle gestite, consulta Utilizzare IAM per le cartelle gestite.

Role	Permissions
Storage Admin (roles/storage.admin) Grants full control of objects and buckets. When applied to an individual bucket, control applies only to the specified bucket and objects within the bucket. Lowest-level resources where you can grant this role: Bucket	cloudaicompanion.instances.completeTask cloudkms.keyHandles.* cloudkms.keyHandles.create cloudkms.keyHandles.get cloudkms.keyHandles.list cloudkms.operations.get cloudkms.projects.showEffectiveAutokeyConfig firebase.projects.get monitoring.dashboards.get monitoring.dashboards.list monitoring.groups.get monitoring.groups.list monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.* monitoring.monitoredResourceDescriptors.get monitoring.monitoredResourceDescriptors.list monitoring.timeSeries.* monitoring.timeSeries.create monitoring.timeSeries.list orgpolicy.policy.get recommender.iamPolicyInsights.* recommender.iamPolicyInsights.get recommender.iamPolicyInsights.list recommender.iamPolicyInsights.update recommender.iamPolicyRecommendations.* recommender.iamPolicyRecommendations.get recommender.iamPolicyRecommendations.list recommender.iamPolicyRecommendations.update recommender.storageBucketSoftDeleteInsights.* recommender.storageBucketSoftDeleteInsights.get recommender.storageBucketSoftDeleteInsights.list recommender.storageBucketSoftDeleteInsights.update recommender.storageBucketSoftDeleteRecommendations.* recommender.storageBucketSoftDeleteRecommendations.get recommender.storageBucketSoftDeleteRecommendations.list recommender.storageBucketSoftDeleteRecommendations.update resourcemanager.hierarchyNodes.listEffectiveTags resourcemanager.projects.get resourcemanager.projects.list stackdriver.projects.get stackdriver.resourceMetadata.list storage.anywhereCaches.* storage.anywhereCaches.create storage.anywhereCaches.disable storage.anywhereCaches.get storage.anywhereCaches.list storage.anywhereCaches.pause storage.anywhereCaches.resume storage.anywhereCaches.update storage.bucketOperations.* storage.bucketOperations.cancel storage.bucketOperations.get storage.bucketOperations.list storage.buckets.* storage.buckets.create storage.buckets.createTagBinding storage.buckets.delete storage.buckets.deleteTagBinding storage.buckets.enableObjectRetention storage.buckets.get storage.buckets.getIamPolicy storage.buckets.getIpFilter storage.buckets.getObjectInsights storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.relocate storage.buckets.restore storage.buckets.setIamPolicy storage.buckets.setIpFilter storage.buckets.update storage.buckets.viewIntelligenceDetails storage.buckets.viewSecurityIntelligenceDetails storage.featureConfigs.* storage.featureConfigs.create storage.featureConfigs.delete storage.featureConfigs.get storage.featureConfigs.list storage.featureConfigs.update storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.intelligenceConfigs.* storage.intelligenceConfigs.get storage.intelligenceConfigs.update storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.managedFolders.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.move storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext storagebatchoperations.* storagebatchoperations.bucketOperations.get storagebatchoperations.bucketOperations.list storagebatchoperations.jobs.cancel storagebatchoperations.jobs.create storagebatchoperations.jobs.delete storagebatchoperations.jobs.get storagebatchoperations.jobs.list storagebatchoperations.locations.get storagebatchoperations.locations.list storagebatchoperations.operations.cancel storagebatchoperations.operations.delete storagebatchoperations.operations.get storagebatchoperations.operations.list
Storage Bucket Viewer ^Beta (roles/storage.bucketViewer) Grants permission to view buckets and their metadata, excluding IAM policies. Lowest-level resources where you can grant this role: Bucket	storage.buckets.get storage.buckets.list
Storage Editor (roles/storage.editor) Editor role for storage Lowest-level resources where you can grant this role: Managed folder	resourcemanager.projects.get resourcemanager.projects.list storage.buckets.create storage.buckets.delete storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.viewIntelligenceDetails storage.buckets.viewSecurityIntelligenceDetails storage.featureConfigs.* storage.featureConfigs.create storage.featureConfigs.delete storage.featureConfigs.get storage.featureConfigs.list storage.featureConfigs.update storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.hmacKeys.* storage.hmacKeys.create storage.hmacKeys.delete storage.hmacKeys.get storage.hmacKeys.list storage.hmacKeys.update storage.intelligenceConfigs.get
Storage Folder Admin (roles/storage.folderAdmin) Grants full control over folders and objects, including listing, creating, viewing, and deleting objects. Lowest-level resources where you can grant this role: Managed folder	orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.managedFolders.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.move storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext
Storage Legacy Bucket Owner (roles/storage.legacyBucketOwner) Grants permission to create, overwrite, and delete objects; list objects in a bucket and read object metadata, excluding allow policies, when listing; and read and edit bucket metadata, including allow policies. Use of this role is also reflected in the bucket's ACLs. For more information, see IAM relation to ACLs. Lowest-level resources where you can grant this role: Bucket	storage.anywhereCaches.* storage.anywhereCaches.create storage.anywhereCaches.disable storage.anywhereCaches.get storage.anywhereCaches.list storage.anywhereCaches.pause storage.anywhereCaches.resume storage.anywhereCaches.update storage.bucketOperations.* storage.bucketOperations.cancel storage.bucketOperations.get storage.bucketOperations.list storage.buckets.createTagBinding storage.buckets.deleteTagBinding storage.buckets.enableObjectRetention storage.buckets.get storage.buckets.getIamPolicy storage.buckets.getIpFilter storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.relocate storage.buckets.restore storage.buckets.setIamPolicy storage.buckets.setIpFilter storage.buckets.update storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.managedFolders.* storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.getIamPolicy storage.managedFolders.list storage.managedFolders.setIamPolicy storage.managedFolders.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.list storage.objects.restore storage.objects.setRetention storage.objects.updateContext
Storage Legacy Bucket Reader (roles/storage.legacyBucketReader) Grants permission to list a bucket's contents and read bucket metadata, excluding allow policies. Also grants permission to read object metadata, excluding allow policies, when listing objects. Use of this role is also reflected in the bucket's ACLs. For more information, see IAM relation to ACLs. Lowest-level resources where you can grant this role: Bucket	storage.buckets.get storage.folders.get storage.folders.list storage.managedFolders.get storage.managedFolders.list storage.multipartUploads.list storage.objects.list
Storage Legacy Bucket Writer (roles/storage.legacyBucketWriter) Grants permission to create, overwrite, and delete objects; list objects in a bucket and read object metadata, excluding allow policies, when listing; and read bucket metadata, excluding allow policies. Use of this role is also reflected in the bucket's ACLs. For more information, see IAM relation to ACLs. Lowest-level resources where you can grant this role: Bucket	storage.buckets.get storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.list storage.managedFolders.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.list storage.objects.restore storage.objects.setRetention
Storage Legacy Object Owner (roles/storage.legacyObjectOwner) Grants permission to view and edit objects and their metadata, including ACLs. Lowest-level resources where you can grant this role: Managed folder	storage.objects.createContext storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.overrideUnlockedRetention storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext
Storage Legacy Object Reader (roles/storage.legacyObjectReader) Grants permission to view objects and their metadata, excluding ACLs. Lowest-level resources where you can grant this role: Managed folder	storage.objects.get
Storage Object Admin (roles/storage.objectAdmin) Grants full control of objects, including listing, creating, viewing, and deleting objects. Lowest-level resources where you can grant this role: Managed folder	monitoring.timeSeries.create orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.list storage.managedFolders.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.* storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.getIamPolicy storage.objects.list storage.objects.move storage.objects.overrideUnlockedRetention storage.objects.restore storage.objects.setIamPolicy storage.objects.setRetention storage.objects.update storage.objects.updateContext
Storage Object Creator (roles/storage.objectCreator) Allows users to create objects. Does not give permission to view, delete, or overwrite objects. Lowest-level resources where you can grant this role: Managed folder	orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list storage.folders.create storage.managedFolders.create storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.listParts storage.objects.create storage.objects.createContext
Storage Object User (roles/storage.objectUser) Access to create, read, update and delete objects and multipart uploads in GCS. Lowest-level resources where you can grant this role: Managed folder	monitoring.timeSeries.create orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list storage.folders.* storage.folders.create storage.folders.delete storage.folders.get storage.folders.list storage.folders.rename storage.managedFolders.create storage.managedFolders.delete storage.managedFolders.get storage.managedFolders.list storage.managedFolders.update storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.create storage.objects.createContext storage.objects.delete storage.objects.deleteContext storage.objects.get storage.objects.list storage.objects.move storage.objects.restore storage.objects.update storage.objects.updateContext
Storage Object Viewer (roles/storage.objectViewer) Grants access to view objects and their metadata, excluding ACLs. Can also list the objects in a bucket. Lowest-level resources where you can grant this role: Managed folder	resourcemanager.projects.get resourcemanager.projects.list storage.folders.get storage.folders.list storage.managedFolders.get storage.managedFolders.list storage.objects.get storage.objects.list
Storage Viewer (roles/storage.viewer) Viewer role for storage Lowest-level resources where you can grant this role: Managed folder	resourcemanager.projects.get resourcemanager.projects.list storage.buckets.list storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.viewIntelligenceDetails storage.buckets.viewSecurityIntelligenceDetails storage.featureConfigs.get storage.featureConfigs.list storage.folders.get storage.folders.list storage.hmacKeys.get storage.hmacKeys.list storage.intelligenceConfigs.get
Storage Annotation Generator Service ^Beta (roles/storage.annotationGeneratorService) Grants all permissions needed to generate annotations for objects in a bucket. Lowest-level resources where you can grant this role: Managed folder	storage.objects.createContext storage.objects.deleteContext storage.objects.get storage.objects.list storage.objects.update storage.objects.updateContext
Storage Express Mode Service Input ^Beta (roles/storage.expressModeServiceInput) Grants permission to Express Mode service accounts at a managed folder so they can create objects but not read them on input folders. Lowest-level resources where you can grant this role: Managed folder	storage.objects.create storage.objects.delete storage.objects.list storage.objects.update
Storage Express Mode Service Output ^Beta (roles/storage.expressModeServiceOutput) Grants permission to Express Mode service accounts at a managed folder so they can read objects but not write them on output folders. Lowest-level resources where you can grant this role: Managed folder	storage.objects.delete storage.objects.get storage.objects.list
Storage Express Mode User Access ^Beta (roles/storage.expressModeUserAccess) Grants permission to Express Mode accounts at the project level so they can read, list, create and delete any object in any of their buckets in Express Mode. Lowest-level resources where you can grant this role: Project	orgpolicy.policy.get storage.buckets.get storage.buckets.list storage.multipartUploads.* storage.multipartUploads.abort storage.multipartUploads.create storage.multipartUploads.list storage.multipartUploads.listParts storage.objects.create storage.objects.delete storage.objects.get storage.objects.list storage.objects.restore storage.objects.update
Storage HMAC Key Admin (roles/storage.hmacKeyAdmin) Full control of Cloud Storage HMAC keys. Lowest-level resources where you can grant this role: Project	firebase.projects.get orgpolicy.policy.get resourcemanager.projects.get resourcemanager.projects.list storage.hmacKeys.* storage.hmacKeys.create storage.hmacKeys.delete storage.hmacKeys.get storage.hmacKeys.list storage.hmacKeys.update
Storage Insights Collector Service (roles/storage.insightsCollectorService) Read-only access to Cloud Storage Inventory metadata for Storage Insights. Lowest-level resources where you can grant this role: Bucket	resourcemanager.projects.get resourcemanager.projects.list storage.buckets.get storage.buckets.getObjectInsights

Nota: tieni presente quanto segue per le autorizzazioni:

• L'autorizzazione orgpolicy.policy.get consente alle entità di conoscere i vincoli delle policy dell'organizzazione a cui è soggetto un progetto. Questa autorizzazione è efficace solo se il ruolo viene concesso a livello di progetto o superiore.
• Per ulteriori informazioni sulle autorizzazioni resourcemanager.projects.*, consulta Controllo dell'accesso ai progetti con IAM.
• Le autorizzazioni storagebatchoperations.jobs.* e storagebatchoperations.operations.* consentono di creare e gestire i job delle operazioni batch di archiviazione. Queste autorizzazioni sono efficaci solo se il ruolo viene concesso a livello di progetto.

Ruoli predefiniti di Storage Insights

La tabella seguente descrive i ruoli IAM associati a Storage Insights ed elenca le autorizzazioni contenute in ciascun ruolo.

Role	Permissions
Storage Insights Admin (roles/storageinsights.admin) Full access to Storage Insights resources.	resourcemanager.projects.get resourcemanager.projects.list storageinsights.* storageinsights.datasetConfigs.create storageinsights.datasetConfigs.delete storageinsights.datasetConfigs.get storageinsights.datasetConfigs.linkDataset storageinsights.datasetConfigs.list storageinsights.datasetConfigs.unlinkDataset storageinsights.datasetConfigs.update storageinsights.locations.get storageinsights.locations.list storageinsights.operations.cancel storageinsights.operations.delete storageinsights.operations.get storageinsights.operations.list storageinsights.reportConfigs.create storageinsights.reportConfigs.delete storageinsights.reportConfigs.get storageinsights.reportConfigs.list storageinsights.reportConfigs.update storageinsights.reportDetails.get storageinsights.reportDetails.list
Storage Insights Viewer (roles/storageinsights.viewer) Read-only access to Storage Insights resources.	resourcemanager.projects.get resourcemanager.projects.list storageinsights.datasetConfigs.get storageinsights.datasetConfigs.list storageinsights.locations.* storageinsights.locations.get storageinsights.locations.list storageinsights.operations.get storageinsights.operations.list storageinsights.reportConfigs.get storageinsights.reportConfigs.list storageinsights.reportDetails.* storageinsights.reportDetails.get storageinsights.reportDetails.list
Storage Insights Analyst (roles/storageinsights.analyst) Data access to Storage Insights.	resourcemanager.projects.get resourcemanager.projects.list storageinsights.datasetConfigs.get storageinsights.datasetConfigs.linkDataset storageinsights.datasetConfigs.list storageinsights.datasetConfigs.unlinkDataset storageinsights.locations.* storageinsights.locations.get storageinsights.locations.list storageinsights.operations.get storageinsights.operations.list storageinsights.reportConfigs.get storageinsights.reportConfigs.list storageinsights.reportDetails.* storageinsights.reportDetails.get storageinsights.reportDetails.list

Service agent roles

Service agent roles should only be granted to service agents.

Role	Permissions
StorageInsights Service Agent (roles/storageinsights.serviceAgent) Permissions for Insights to write reports into customer project Warning: Do not grant service agent roles to any principals except service agents.	bigquery.datasets.create serviceusage.services.use storageinsights.reportDetails.list

Ruoli di base

Nota: se possibile, devi ridurre al minimo l'utilizzo dei ruoli di base e, negli ambienti di produzione, non concedere ruoli di base a meno che non ci siano alternative. I ruoli di base contengono un'ampia gamma di autorizzazioni per tutti i Google Cloud servizi e hanno un comportamento potenzialmente sorprendente in Cloud Storage, come descritto in questa sezione.

I ruoli di base sono ruoli esistenti prima di IAM. Questi ruoli hanno caratteristiche uniche:

• I ruoli di base possono essere concessi solo per un intero progetto, non per singoli bucket all'interno del progetto. Come gli altri ruoli concessi per un progetto, i ruoli di base si applicano a tutti i bucket e gli oggetti del progetto.

• I ruoli di base contengono autorizzazioni aggiuntive per altri Google Cloud servizi non trattati in questa sezione. Consulta Ruoli di base per una discussione generale sulle autorizzazioni concesse dai ruoli di base.

• Ogni ruolo di base ha un valore di convenienza che ti consente di utilizzare il ruolo di base come se fosse un gruppo. Se utilizzato in questo modo, qualsiasi entità con il ruolo di base viene considerata parte del gruppo. Tutti i membri del gruppo ottengono un accesso aggiuntivo alle risorse in base all'accesso del valore di convenienza.

  • I valori di convenienza possono essere utilizzati quando si concedono ruoli per i bucket.

  • I valori di convenienza possono essere utilizzati quando si impostano gli ACL sugli oggetti.

• I ruoli di base non forniscono intrinsecamente tutto l'accesso alle risorse Cloud Storage che i loro nomi implicano. Forniscono invece una parte dell'accesso previsto in modo intrinseco e il resto dell'accesso previsto tramite l'utilizzo di valori di convenienza. Poiché i valori di convenienza possono essere aggiunti o rimossi manualmente come qualsiasi altra entità IAM, è possibile revocare l'accesso che le entità potrebbero altrimenti aspettarsi di avere.

  Per una discussione sull'accesso aggiuntivo che le entità con ruoli di base in genere ottengono grazie ai valori di convenienza, consulta Comportamento modificabile.

Autorizzazioni intrinseche

La tabella seguente descrive le autorizzazioni di Cloud Storage sempre associate a ogni ruolo di base.

Ruolo	Descrizione	Autorizzazioni di Cloud Storage
Visualizzatore (roles/viewer)	Concede l'autorizzazione per elencare i bucket nel progetto, visualizzare i metadati dei bucket durante l'elenco (esclusi gli ACL) ed elencare e recuperare le chiavi HMAC nel progetto.	storage.buckets.getIpFilter storage.buckets.list storage.hmacKeys.get storage.hmacKeys.list
Editor (roles/editor)	Concede l'autorizzazione per creare, elencare ed eliminare i bucket nel progetto; visualizzare i metadati dei bucket durante l'elenco (esclusi gli ACL) e controllare le chiavi HMAC nel progetto.	storage.buckets.create storage.buckets.delete storage.buckets.getIpFilter storage.buckets.list storage.hmacKeys.*
Proprietario (roles/owner)	Concede l'autorizzazione per creare, elencare ed eliminare i bucket nel progetto, visualizzare i metadati dei bucket durante l'elenco (esclusi gli ACL), creare, eliminare ed elencare le associazioni di tag e controllare le chiavi HMAC nel progetto; abilitare, disabilitare, aggiornare e recuperare la configurazione di Storage Intelligence su un progetto, una cartella o un'organizzazione. Google Cloud In generale, le entità con questo ruolo possono eseguire attività amministrative come modificare i ruoli delle entità per il progetto o modificare la fatturazione.	storage.buckets.create storage.buckets.delete storage.buckets.list storage.buckets.createTagBinding storage.buckets.deleteTagBinding storage.buckets.getIpFilter storage.buckets.listEffectiveTags storage.buckets.listTagBindings storage.buckets.setIpFilter storage.hmacKeys.* storage.intelligenceConfigs.get storage.intelligenceConfigs.update

Comportamento modificabile

Le entità a cui sono stati concessi ruoli di base spesso hanno accesso aggiuntivo ai bucket e agli oggetti di un progetto grazie ai valori di convenienza. Quando viene creato un bucket, ai valori di convenienza viene concesso un determinato accesso a livello di bucket, ma in un secondo momento puoi modificare le policy IAM del bucket e gli ACL degli oggetti per rimuovere o modificare l'accesso.

Quando crei un bucket con l'accesso uniforme a livello di bucket abilitato, il seguente accesso viene concesso tramite i valori di convenienza:

• Le entità a cui è stato concesso roles/viewer ottengono i ruoli roles/storage.legacyBucketReader e roles/storage.legacyObjectReader per il bucket.

• Le entità a cui è stato concesso roles/editor ottengono i ruoli roles/storage.legacyBucketOwner e roles/storage.legacyObjectOwner per il bucket.

• Le entità a cui è stato concesso roles/owner ottengono i ruoli roles/storage.legacyBucketOwner e roles/storage.legacyObjectOwner per il bucket.

Quando crei un bucket senza l'accesso uniforme a livello di bucket abilitato, il seguente accesso viene concesso tramite i valori di convenienza:

• Le entità a cui è stato concesso roles/viewer ottengono il ruolo roles/storage.legacyBucketReader per il bucket.

• Le entità a cui è stato concesso roles/editor ottengono il ruolo roles/storage.legacyBucketOwner per il bucket.

• Le entità a cui è stato concesso roles/owner ottengono il ruolo roles/storage.legacyBucketOwner per il bucket.

• Inoltre, il bucket ha un elenco di controllo dell'accesso (ACL) degli oggetti predefinito. Questo ACL predefinito viene spesso applicato ai nuovi oggetti nel bucket e spesso concede un accesso aggiuntivo ai valori di convenienza.

Ruoli personalizzati

Potresti voler definire i tuoi ruoli contenenti bundle di autorizzazioni che specifichi. Per supportare questa funzionalità, IAM offre ruoli personalizzati.

Passaggi successivi

• Utilizza le autorizzazioni IAM per controllare l'accesso a bucket e oggetti.

• Scopri di più su ogni autorizzazione IAM per Cloud Storage.

• Consulta i riferimenti IAM disponibili per Cloud Storage, ad esempio quali autorizzazioni IAM consentono agli utenti di eseguire azioni con vari strumenti e API.

• Per un riferimento ad altri Google Cloud ruoli, consulta Informazioni sui ruoli.