GCP Bucket Permissions by Prefix

Question

I would like to give a user permission to upload files to my GCP bucket, but only if the file contains a certain prefix.

Is this possible or do I have to create a separate bucket?

Answer 1

Yes, this is possible you can check the file prefix before uploading it to the GCP bucket. But in GCP there have no option to give permission for files prefix.

Also, To learn about other ways to control access to buckets and objects, read Overview of Access Control .

Answer 2

It is possible to give fine grained ("folder") permissions on google cloud storage. Check this blog post[1]

You need to use IAM conditions when giving permission.

Use a condition to match against a prefix:

resource.name.startsWith("projects/_/buckets/<bucket_name>/objects/<root_folder>/<another_folder>")

This will give the permission only to gcs objects with names starting with /<root_folder>/<another_folder> on the bucket <bucket_name> for the current project (the _ is literal, it should be a literal _ , NOT the project id).

https://archive.is/https://gcpfreaks.medium.com/restricting-write-permissions-on-folders-in-google-cloud-storage-with-iam-conditions-e82f36e47639