Question

A data analyst reports she can no longer download objects from a Cloud Storage bucket named 'analytics-exports' in the project 'data-prod'. She belongs to three Google Groups, and IAM bindings exist at the organization, folder, and project levels. You need to determine exactly which allow or deny policy is granting or blocking her 'storage.objects.get' permission on that specific bucket, with the least manual effort. What should you do?

Accepted Answer

Use IAM Policy Troubleshooter, specifying the analyst's principal, the bucket resource, and the 'storage.objects.get' permission to see the evaluated access and the contributing bindings.

Answer

Export all IAM allow policies at the organization, folder, and project levels with 'gcloud' and manually inspect each binding to find the analyst's group memberships.

Answer

Enable Data Access audit logs for Cloud Storage and search Cloud Logging for the analyst's denied requests to identify the missing role.

Answer

Run 'gcloud projects get-iam-policy data-prod' and check whether the analyst is directly listed with the Storage Object Viewer role.