GCS 403 Account Disabled means billing is off, not IAM

TL;DR

Full error looks like: 403 Account Disabled on gcloud storage buckets create or any mutating call.

Steps

1. Meaning: the project is not attached to an open billing account. Cloud Storage requires billing for most operations. This is not an IAM problem; adding roles will not help.
2. Fix:
3. Confirm: gcloud billing projects describe [PROJECT] shows no billing account, or the console billing page shows none linked.
4. Link a billing account: console Billing page, or gcloud billing projects link [PROJECT] --billing-account [ACCOUNT-ID].
5. Retry the create.
6. Notes:

• Listing buckets can work while creating fails, which confuses people into thinking auth is fine. Reads are cheaper; the billing gate hits writes first in some paths.
• Fresh projects from automation often skip billing setup. If your provisioning script creates the project, link billing in the same script before creating anything else.
• The same root cause surfaces elsewhere as billingNotEnabled (BigQuery) or "billing account is not open" errors. Learn the family, not just the instance.

4. Verify: gcloud billing projects describe [PROJECT] shows billingEnabled true, then the create succeeds.

When to use

You are seeing this: Meaning: the project is not attached to an open billing account. Use this skill when you run into "GCS 403 Account Disabled means billing is off, not IAM".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Verified 2026-09-26 on the GCS troubleshooting docs: 403 Account Disabled explicitly indicates billing is not turned on for the project, with a pointer to enable billing. Distinct from IAM 403s.