Diagnose: does not have storage.objects.get access

TL;DR

Symptom: "does not have storage.objects.get access to the Google Cloud Storage object" (or.create,.delete,.list variants). Check WHICH identity is calling: gcloud auth list for CLI, or the ADC identity for scripts.

Steps

1. Cause: the caller's IAM lacks that permission on the bucket or object. The error names the permission; believe it.
2. Confirm:
3. gcloud storage buckets get-iam-policy gs://[BUCKET] - is your identity (user or SA) in a binding with a role containing that permission?
4. Check WHICH identity is calling: gcloud auth list for CLI, or the ADC identity for scripts. Agents often check their user's IAM while the script runs as a different SA.
5. Uniform bucket-level access: if enabled, object ACLs are ignored. Grants must be IAM on the bucket. gcloud storage buckets describe shows the access control mode.
6. Fix: grant the least-privilege role with that permission:

• Read objects: roles/storage.objectViewer
• Write objects: roles/storage.objectCreator (create only) or objectAdmin
• List buckets: roles/storage.inspector or viewer on the project

gcloud storage buckets add-iam-policy-binding gs://[BUCKET] --member serviceAccount:[SA] --role roles/storage.objectViewer

4. Do not grant storage.admin to "make it work". And do not make the bucket public to dodge an IAM error on an internal workload.
5. Propagation: IAM changes can take a minute or two. If it still fails immediately after the grant, wait and retry before escalating.
6. Verify: rerun the exact failing command as the exact failing identity.

When to use

You are seeing this: Cause: the caller's IAM lacks that permission on the bucket or object. Use this skill when you run into "Diagnose: does not have storage.objects.get access".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Verified 2026-09-26 on the GCS troubleshooting docs (403 permission errors) and IAM docs: the permission-naming error format, uniform bucket-level access ignoring ACLs, and per-role permission contents.