0

we have one bucket contain data of multi clients, separated by "folders" (of course its not really folders, but keys..) we want to sync data from each folder to the clients bucket, by rsync, for that the client supply us a "service-account" with access to his bucket, the problem is, how can we restrict that service-account to read only from the specific folder?

e.g.

my_bucket/client1/data

my_bucket/client2/data

client1-service-account should be able to list+read from: my_bucket/client1/*

RELW
  • 189
  • 1
  • 14

2 Answers2

2

You can use Google Storage ACL to allow an email (user email or service account email) to access to a subset of files into a bucket.

HOWEVER, directory doesn't exist in Google Cloud Storage. The real name is "prefix" or "path". Indeed, if you no longer have file with a certain "prefix", it disappear, without explicit deletion. I means, it's not a resource and thus you can't set ACL on a directory, only on BLOB.

Therefore, if you add files in a directory, you also have to set the correct ACL on these files (or reset the ACL on the whole prefix). The ACL aren't inherited for the new files.

guillaume blaquiere
  • 66,369
  • 2
  • 47
  • 76
  • 10x, and that is my problem.. I want to have permanent permission to all (future) files with specific prefix. It is possible in AWS, and I didn't find any way to do so on GCP – RELW Jul 27 '20 at 12:41
  • The best pattern is to use a bucket per customer. If you can't (because the data are all sink into the same bucket but in different "folder"), you can image to set a storage transfer between the main bucket to the customer folder. I don't know what is the acceptable latency for your customer between the file creation and the availability into Cloud Storage. – guillaume blaquiere Jul 27 '20 at 13:04
0

found some workaround:

instead of using the customers service-accounts, we will use our own service-accounts, and give the customer to grant write permission to their bucket, so the customer will not have access to our bucket. it doesn't cover all the requirements, but it something..

RELW
  • 189
  • 1
  • 14