Google IAM Policy Troubleshooter says allowed, but a storage request still fails

0 reputation · 18 Nov 2021, 06:55 UTC

146.4K views2

A service’s storage request is denied. In this illustrative case, Policy Troubleshooter reports that the named principal has the permission on the resource. The team has not checked whether the actual call crosses a VPC Service Controls boundary. Does the allowed result settle the whole access question?

Environment

Editorial worked example. See the question for the scenario and assumptions.

1,951 following

Keep exploring this topic

A Cloud Run revision deploys, but new instances cannot retrieve an environment secret

A worked Cloud Run example references an enabled Secret Manager version as an environment variable. The deployer’s account can access the secret. The service uses a dedicated runtime service account, and new instances fail around startup. Which identity and permission should be checked?

Why do Cloud Run instances see different values when an environment secret uses latest?

A fictional service exposes a secret through an environment variable using latest. After rotation, older instances keep working with the previous credential while newly started instances use the new one. The application team expected an immediate, simultaneous update. What deployment approach gives a more predictable result?

A non-root Cloud Run container starts but cannot read its mounted secret file

An example container was changed to run as a non-root user. It starts, but reading a mounted Secret Manager file fails. The team verified that the runtime service account has secret access. What should be checked next, and why is this different from an environment-secret startup failure?

Public Access Prevention and Legacy ACL Evaluation Order

Public Access Prevention vs legacy ACLs: evaluation order and automatic revocation behavior for AllUsers read access.

It settles only what the tool evaluated with the supplied inputs. Confirm the actual caller, resource, permission and relevant request context first. Policy Troubleshooter does not diagnose VPC Service Controls violations, and its documentation also describes limits involving Cloud Storage ACLs.

If those inputs match, investigate the separate boundary using the appropriate service diagnostics or violation analyzer. Adding a broader IAM role may not change a perimeter violation and can unnecessarily expand permissions. Keep the policy finding and the request outcome as separate observations until the complete path is explained.

Google IAM Policy Troubleshooter says allowed, but a storage request still fails

2 answers

Your perspective belongs here.

0 question comments