<p>I am not entirely sure what configs you were using, but here is a process using CLI (gcloud and gsutil). The end product is a new custom role replacing the current standard roles/storage.objectViewer on allUsers for a GCP Bucket.</p>
<p>Recommend using GCP Cloud Cloud Shell in your Project: <a href="https://cloud.google.com/shell" rel="nofollow noreferrer">https://cloud.google.com/shell</a></p>
<ol>
<li>Create a new Role with the Custom Permissions you would like.</li>
</ol>
<p>Create yaml file to hold the new config:</p>
<pre><code>vi custom_role.yaml
</code></pre>
<p>Add role configurations to new custom_role.yaml:</p>
<pre><code>title: &quot;storageobjectviewer.nolist&quot;
description: &quot;Storage Object Viewer Role without source objects list&quot;
stage: &quot;ALPHA&quot;
includedPermissions:
- resourcemanager.projects.get
- storage.objects.get
</code></pre>
<p>Create new Role in GCP:</p>
<pre><code>gcloud iam roles create storageobjectviewer.nolist --project=[YOUR PROJECT] --file=custom_role.yaml
</code></pre>
<ol start="2">
<li>Pull current permissions for [YOUR BUCKET] locally:</li>
</ol>
<blockquote>
<p>gsutil iam get gs://[YOUR BUCKET] &gt; perms.txt</p>
</blockquote>
<ol start="3">
<li>Update Permissions with the new role.</li>
</ol>
<p>Should only be this section:</p>
<blockquote>
<pre><code>{
  &quot;members&quot;: [
    &quot;allUsers&quot;
  ],
  &quot;role&quot;: &quot;projects/[YOUR PROJECT]/roles/storageobjectviewer.nolist&quot;
}
</code></pre>
</blockquote>
<ol start="4">
<li>Update the allUsers to the new role on [YOUR BUCKET]</li>
</ol>
<blockquote>
<p>gsutil iam set perms.txt  gs://[YOUR BUCKET]</p>
</blockquote>
<p>The new configuration should be viewable in CLI:</p>
<pre><code>gsutil iam get gs://[YOUR BUCKET]
</code></pre>
<p>Also in the UI:
Bucket Details -&gt; Permissions
<a href="https://i.sstatic.net/Y2IE3.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/Y2IE3.jpg" alt="enter image description here" /></a></p>
<p>and IAM -&gt; Roles
<a href="https://i.sstatic.net/wO4QG.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/wO4QG.jpg" alt="enter image description here" /></a>
Hopefully this helps!</p>
<p>Additional Info:</p>
<ul>
<li><a href="https://cloud.google.com/iam/docs/creating-custom-roles#iam-custom-roles-create-gcloud" rel="nofollow noreferrer">https://cloud.google.com/iam/docs/creating-custom-roles#iam-custom-roles-create-gcloud</a></li>
<li><a href="https://cloud.google.com/storage/docs/gsutil/commands/iam" rel="nofollow noreferrer">https://cloud.google.com/storage/docs/gsutil/commands/iam</a></li>
<li><a href="https://cloud.google.com/storage/docs/access-control/making-data-public#gsutil" rel="nofollow noreferrer">https://cloud.google.com/storage/docs/access-control/making-data-public#gsutil</a></li>
<li><a href="https://cloud.google.com/storage/docs/access-control/iam-roles" rel="nofollow noreferrer">https://cloud.google.com/storage/docs/access-control/iam-roles</a></li>
</ul>

CC BY-SA 4.0
2020-10-12T18:51:12.620Z
2020-10-12T18:51:12.620Z
George
<p>Google Cloud Platform Storage Buckets can be directly exposed via HTTP. The recommended configuration for this is to have <code>allUsers</code> with the <code>Storage Object Viewer</code> role. </p>

<p>The Storage Object Viewer role has got storage.bucket.list permission. I tried creating a custom role based on this role and removed the storage.bucket.list permission.</p>

<p>I updated the IAM permissions by getting permissions with gcutil, editing, then I tried to update.</p>

<p>When I tried updating I used the following command</p>

<p><code>gsutil iam set permissions.txt gs://example.com/</code></p>

<p>But I got the following error </p>

<blockquote>
  <p>BadRequestException: 400 Role roles/CustomStorageObjectViewer is not
  supported for this resource.</p>
</blockquote>

<p>Is there any way to configure a public gcp storage bucket without the storage.bucket.list permission?</p>

CC BY-SA 4.0
2019-12-24T14:57:22.227Z
The Q&A seems to be answered [here](https://stackoverflow.com/q/54365061/2777965)
030
CC BY-SA 4.0
2020-04-07T17:36:53.707Z
I have the exact same question and I fail to see how the provided link provides an answer.
DavidM
CC BY-SA 4.0
2020-04-09T02:36:29.250Z
@030 Any chance of reopening this question. I believe it was closed by mistake.
Kind Contributor
CC BY-SA 4.0
2020-04-09T07:30:20.073Z
@Todd Q&A has been reopened.
030
<gcp>
How to exclude storage.bucket.list permission on public gcp storage bucket
Kind Contributor
# How to exclude storage.bucket.list permission on public gcp storage bucket

(Asked by: username_0 on 2018-12-18)

Google Cloud Platform Storage Buckets can be directly exposed via HTTP. The recommended configuration for this is to have `allUsers` with the `Storage Object Viewer` role.

The Storage Object Viewer role has got storage.bucket.list permission. I tried creating a custom role based on this role and removed the storage.bucket.list permission.

I updated the IAM permissions by getting permissions with gcutil, editing, then I tried to update.

When I tried updating I used the following command

`gsutil iam set permissions.txt gs://example.com/`

But I got the following error

> BadRequestException: 400 Role roles/CustomStorageObjectViewer is not
> supported for this resource.

Is there any way to configure a public gcp storage bucket without the storage.bucket.list permission?

**Tags:** gcp

> **Comments:**
> **username_1**: The Q&A seems to be answered [here](https://stackoverflow.com/q/54365061/2777965)  
> **username_2**: I have the exact same question and I fail to see how the provided link provides an answer.  
> **username_0**: @username_1 Any chance of reopening this question. I believe it was closed by mistake.  
> **username_1**: @Todd Q&A has been reopened.  

---

## 1 answers

### Answer by username_3 on 2020-10-12. Score: 2 | Accepted answer

I am not entirely sure what configs you were using, but here is a process using CLI (gcloud and gsutil). The end product is a new custom role replacing the current standard roles/storage.objectViewer on allUsers for a GCP Bucket.
Recommend using GCP Cloud Cloud Shell in your Project: https://cloud.google.com/shell

Create a new Role with the Custom Permissions you would like.

Create yaml file to hold the new config:
vi custom_role.yaml

Add role configurations to new custom_role.yaml:
title: "storageobjectviewer.nolist"
description: "Storage Object Viewer Role without source objects list"
stage: "ALPHA"
includedPermissions:
- resourcemanager.projects.get
- storage.objects.get

Create new Role in GCP:
gcloud iam roles create storageobjectviewer.nolist --project=[YOUR PROJECT] --file=custom_role.yaml


Pull current permissions for [YOUR BUCKET] locally:


gsutil iam get gs://[YOUR BUCKET] > perms.txt


Update Permissions with the new role.

Should only be this section:

{
  "members": [
    "allUsers"
  ],
  "role": "projects/[YOUR PROJECT]/roles/storageobjectviewer.nolist"
}



Update the allUsers to the new role on [YOUR BUCKET]


gsutil iam set perms.txt  gs://[YOUR BUCKET]

The new configuration should be viewable in CLI:
gsutil iam get gs://[YOUR BUCKET]

Also in the UI:
Bucket Details -> Permissions

and IAM -> Roles

Hopefully this helps!
Additional Info:

https://cloud.google.com/iam/docs/creating-custom-roles#iam-custom-roles-create-gcloud
https://cloud.google.com/storage/docs/gsutil/commands/iam
https://cloud.google.com/storage/docs/access-control/making-data-public#gsutil
https://cloud.google.com/storage/docs/access-control/iam-roles


---

