Can add file but cannot set metadata in Google Cloud Storage

Question

I can copy file to Google Cloud Storage:

% gsutil -m cp audio/index.csv gs://passive-english/audio/
If you experience problems with multiprocessing on MacOS, they might be related to https://bugs.python.org/issue33725. You can disable multiprocessing by editing your .boto config or by adding the following flag to your command: `-o "GSUtil:parallel_process_count=1"`. Note that multithreading is still available even if you disable multiprocessing.

Copying file://audio/index.csv [Content-Type=text/csv]...
\ [1/1 files][196.2 KiB/196.2 KiB] 100% Done
Operation completed over 1 objects/196.2 KiB.

But I can't change it metadata:

% gsutil setmeta -h "Cache-Control:public, max-age=7200" gs://passive-english/audio/index.csv
Setting metadata on gs://passive-english/audio/index.csv...
AccessDeniedException: 403 Access denied.

I'm authorizing using json file:

% env | grep GOOGL
GOOGLE_APPLICATION_CREDENTIALS=/app-342xxx-2cxxxxxx.json

How can I grant access so that gsutil can change metadata for the file?

Update 1:

I give the service account role Editor and Storage Object Admin permission.

Update 2 : I give the service account role Owner and Storage Object Admin permission. Still no use

Answer 1

To update an object's metadata you need the IAM permission storage.objects.update .

That permission is contained in the roles:

• `Storage Object Admin (roles/storage.objectAdmin)
• `Storage Admin (roles/storage.admin)

To add the required role using the CLI:

gcloud projects add-iam-policy-binding ${GCP_PROJECT_ID} \
    --member=serviceAccount:${GCP_SERVICE_ACCOUNT_EMAIL}
    --role=REPLACE_WITH_REQUIRED_ROLE (e.g. roles/storage.objectAdmin)

Using the Google Cloud Console GUI:

• In the Cloud Console, go to the IAM & Admin -> IAM page.
• Locate the service account.
• Click the pencil icon on the right hand side.
• Click ADD ROLE.
• Select one of the required roles.

Answer 2

I tried to update metadata, I can able to successfully edit without errors.

According todocumention , you need to have Owner role on the object to edit meatadata.

you can also refer this document1 & 2