Answers: <p>I am not entirely sure what configs you were using, but here is a process using CLI (gcloud and gsutil). The end product is a new custom role replacing the current standard roles/storage.objectViewer on allUsers for a GCP Bucket.</p>
  <p>Recommend using GCP Cloud Cloud Shell in your Project: <a href="https://cloud.google.com/shell" rel="nofollow noreferrer">https://cloud.google.com/shell</a></p>
  <ol>
  <li>Create a new Role with the Custom Permissions you would like.</li>
  </ol>
  <p>Create yaml file to hold the new config:</p>
  <pre><code>vi custom_role.yaml
  </code></pre>
  <p>Add role configurations to new custom_role.yaml:</p>
  <pre><code>title: &quot;storageobjectviewer.nolist&quot;
  description: &quot;Storage Object Viewer Role without source objects list&quot;
  stage: &quot;ALPHA&quot;
  includedPermissions:
  - resourcemanager.projects.get
  - storage.objects.get
  </code></pre>
  <p>Create new Role in GCP:</p>
  <pre><code>gcloud iam roles create storageobjectviewer.nolist --project=[YOUR PROJECT] --file=custom_role.yaml
  </code></pre>
  <ol start="2">
  <li>Pull current permissions for [YOUR BUCKET] locally:</li>
  </ol>
  <blockquote>
  <p>gsutil iam get gs://[YOUR BUCKET] &gt; perms.txt</p>
  </blockquote>
  <ol start="3">
  <li>Update Permissions with the new role.</li>
  </ol>
  <p>Should only be this section:</p>
  <blockquote>
  <pre><code>{
    &quot;members&quot;: [
      &quot;allUsers&quot;
    ],
    &quot;role&quot;: &quot;projects/[YOUR PROJECT]/roles/storageobjectviewer.nolist&quot;
  }
  </code></pre>
  </blockquote>
  <ol start="4">
  <li>Update the allUsers to the new role on [YOUR BUCKET]</li>
  </ol>
  <blockquote>
  <p>gsutil iam set perms.txt  gs://[YOUR BUCKET]</p>
  </blockquote>
  <p>The new configuration should be viewable in CLI:</p>
  <pre><code>gsutil iam get gs://[YOUR BUCKET]
  </code></pre>
  <p>Also in the UI:
  Bucket Details -&gt; Permissions
  <a href="https://i.sstatic.net/Y2IE3.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/Y2IE3.jpg" alt="enter image description here" /></a></p>
  <p>and IAM -&gt; Roles
  <a href="https://i.sstatic.net/wO4QG.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/wO4QG.jpg" alt="enter image description here" /></a>
  Hopefully this helps!</p>
  <p>Additional Info:</p>
  <ul>
  <li><a href="https://cloud.google.com/iam/docs/creating-custom-roles#iam-custom-roles-create-gcloud" rel="nofollow noreferrer">https://cloud.google.com/iam/docs/creating-custom-roles#iam-custom-roles-create-gcloud</a></li>
  <li><a href="https://cloud.google.com/storage/docs/gsutil/commands/iam" rel="nofollow noreferrer">https://cloud.google.com/storage/docs/gsutil/commands/iam</a></li>
  <li><a href="https://cloud.google.com/storage/docs/access-control/making-data-public#gsutil" rel="nofollow noreferrer">https://cloud.google.com/storage/docs/access-control/making-data-public#gsutil</a></li>
  <li><a href="https://cloud.google.com/storage/docs/access-control/iam-roles" rel="nofollow noreferrer">https://cloud.google.com/storage/docs/access-control/iam-roles</a></li>
  </ul>
  
Answers: CC BY-SA 4.0
Answers: 2020-10-12T18:51:12.620Z
Answers: 2020-10-12T18:51:12.620Z
Answers: George
Body: <p>Google Cloud Platform Storage Buckets can be directly exposed via HTTP. The recommended configuration for this is to have <code>allUsers</code> with the <code>Storage Object Viewer</code> role. </p>
  
  <p>The Storage Object Viewer role has got storage.bucket.list permission. I tried creating a custom role based on this role and removed the storage.bucket.list permission.</p>
  
  <p>I updated the IAM permissions by getting permissions with gcutil, editing, then I tried to update.</p>
  
  <p>When I tried updating I used the following command</p>
  
  <p><code>gsutil iam set permissions.txt gs://example.com/</code></p>
  
  <p>But I got the following error </p>
  
  <blockquote>
    <p>BadRequestException: 400 Role roles/CustomStorageObjectViewer is not
    supported for this resource.</p>
  </blockquote>
  
  <p>Is there any way to configure a public gcp storage bucket without the storage.bucket.list permission?</p>
  
Comments: CC BY-SA 4.0
Comments: 2019-12-24T14:57:22.227Z
Comments: The Q&A seems to be answered [here](https://stackoverflow.com/q/54365061/2777965)
Comments: 030
Comments: CC BY-SA 4.0
Comments: 2020-04-07T17:36:53.707Z
Comments: I have the exact same question and I fail to see how the provided link provides an answer.
Comments: DavidM
Comments: CC BY-SA 4.0
Comments: 2020-04-09T02:36:29.250Z
Comments: @030 Any chance of reopening this question. I believe it was closed by mistake.
Comments: Kind Contributor
Comments: CC BY-SA 4.0
Comments: 2020-04-09T07:30:20.073Z
Comments: @Todd Q&A has been reopened.
Comments: 030
Tags: <gcp>
Title: How to exclude storage.bucket.list permission on public gcp storage bucket
UserDisplayName: Kind Contributor
ThreadText: # How to exclude storage.bucket.list permission on public gcp storage bucket
  
  (Asked by: username_0 on 2018-12-18)
  
  Google Cloud Platform Storage Buckets can be directly exposed via HTTP. The recommended configuration for this is to have `allUsers` with the `Storage Object Viewer` role.
  
  The Storage Object Viewer role has got storage.bucket.list permission. I tried creating a custom role based on this role and removed the storage.bucket.list permission.
  
  I updated the IAM permissions by getting permissions with gcutil, editing, then I tried to update.
  
  When I tried updating I used the following command
  
  `gsutil iam set permissions.txt gs://example.com/`
  
  But I got the following error
  
  > BadRequestException: 400 Role roles/CustomStorageObjectViewer is not
  > supported for this resource.
  
  Is there any way to configure a public gcp storage bucket without the storage.bucket.list permission?
  
  **Tags:** gcp
  
  > **Comments:**
  > **username_1**: The Q&A seems to be answered [here](https://stackoverflow.com/q/54365061/2777965)  
  > **username_2**: I have the exact same question and I fail to see how the provided link provides an answer.  
  > **username_0**: @username_1 Any chance of reopening this question. I believe it was closed by mistake.  
  > **username_1**: @Todd Q&A has been reopened.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_3 on 2020-10-12. Score: 2 | Accepted answer
  
  I am not entirely sure what configs you were using, but here is a process using CLI (gcloud and gsutil). The end product is a new custom role replacing the current standard roles/storage.objectViewer on allUsers for a GCP Bucket.
  
  Recommend using GCP Cloud Cloud Shell in your Project: <https://cloud.google.com/shell>
  
  1. Create a new Role with the Custom Permissions you would like.
  
  Create yaml file to hold the new config:
  
  ```
  vi custom_role.yaml
  
  ```
  
  Add role configurations to new custom\_role.yaml:
  
  ```
  title: "storageobjectviewer.nolist"
  description: "Storage Object Viewer Role without source objects list"
  stage: "ALPHA"
  includedPermissions:
  - resourcemanager.projects.get
  - storage.objects.get
  
  ```
  
  Create new Role in GCP:
  
  ```
  gcloud iam roles create storageobjectviewer.nolist --project=[YOUR PROJECT] --file=custom_role.yaml
  
  ```
  
  2. Pull current permissions for [YOUR BUCKET] locally:
  
  > gsutil iam get gs://[YOUR BUCKET] > perms.txt
  
  3. Update Permissions with the new role.
  
  Should only be this section:
  
  > ```
  > {
  >   "members": [
  >     "allUsers"
  >   ],
  >   "role": "projects/[YOUR PROJECT]/roles/storageobjectviewer.nolist"
  > }
  >
  > ```
  
  4. Update the allUsers to the new role on [YOUR BUCKET]
  
  > gsutil iam set perms.txt gs://[YOUR BUCKET]
  
  The new configuration should be viewable in CLI:
  
  ```
  gsutil iam get gs://[YOUR BUCKET]
  
  ```
  
  Also in the UI:
  Bucket Details -> Permissions
  [![enter image description here](https://i.sstatic.net/Y2IE3.jpg)](https://i.sstatic.net/Y2IE3.jpg)
  
  and IAM -> Roles
  [![enter image description here](https://i.sstatic.net/wO4QG.jpg)](https://i.sstatic.net/wO4QG.jpg)
  Hopefully this helps!
  
  Additional Info:
  
  * <https://cloud.google.com/iam/docs/creating-custom-roles#iam-custom-roles-create-gcloud>
  * <https://cloud.google.com/storage/docs/gsutil/commands/iam>
  * <https://cloud.google.com/storage/docs/access-control/making-data-public#gsutil>
  * <https://cloud.google.com/storage/docs/access-control/iam-roles>
  
  
  ---
  
  