Add an IAM member

  namespace 
  
 gcs 
  
 = 
  
 :: 
 google 
 :: 
 cloud 
 :: 
 storage 
 ; 
 using 
  
 :: 
 google 
 :: 
 cloud 
 :: 
 StatusOr 
 ; 
 []( 
 gcs 
 :: 
 Client 
  
 client 
 , 
  
 std 
 :: 
 string 
  
 const 
&  
 bucket_name 
 , 
  
 std 
 :: 
 string 
  
 const 
&  
 role 
 , 
  
 std 
 :: 
 string 
  
 const 
&  
 member 
 ) 
  
 { 
  
 auto 
  
 policy 
  
 = 
  
 client 
 . 
 GetNativeBucketIamPolicy 
 ( 
  
 bucket_name 
 , 
  
 gcs 
 :: 
 RequestedPolicyVersion 
 ( 
 3 
 )); 
  
 if 
  
 ( 
 ! 
 policy 
 ) 
  
 throw 
  
 std 
 :: 
 move 
 ( 
 policy 
 ). 
 status 
 (); 
  
 policy 
 - 
> set_version 
 ( 
 3 
 ); 
  
 for 
  
 ( 
 auto 
&  
 binding 
  
 : 
  
 policy 
 - 
> bindings 
 ()) 
  
 { 
  
 if 
  
 ( 
 binding 
 . 
 role 
 () 
  
 != 
  
 role 
  
 || 
  
 binding 
 . 
 has_condition 
 ()) 
  
 { 
  
 continue 
 ; 
  
 } 
  
 auto 
&  
 members 
  
 = 
  
 binding 
 . 
 members 
 (); 
  
 if 
  
 ( 
 std 
 :: 
 find 
 ( 
 members 
 . 
 begin 
 (), 
  
 members 
 . 
 end 
 (), 
  
 member 
 ) 
  
 == 
  
 members 
 . 
 end 
 ()) 
  
 { 
  
 members 
 . 
 emplace_back 
 ( 
 member 
 ); 
  
 } 
  
 } 
  
 auto 
  
 updated 
  
 = 
  
 client 
 . 
 SetNativeBucketIamPolicy 
 ( 
 bucket_name 
 , 
  
 * 
 policy 
 ); 
  
 if 
  
 ( 
 ! 
 updated 
 ) 
  
 throw 
  
 std 
 :: 
 move 
 ( 
 updated 
 ). 
 status 
 (); 
  
 std 
 :: 
 cout 
 << 
 "Updated IAM policy bucket " 
 << 
 bucket_name 
 << 
 ". The new policy is " 
 << 
 * 
 updated 
 << 
 " 
 \n 
 " 
 ; 
 } 
 

  using 
  
 Google.Apis.Storage.v1.Data 
 ; 
 using 
  
  Google.Cloud.Storage.V1 
 
 ; 
 using 
  
 System 
 ; 
 using 
  
 System.Collections.Generic 
 ; 
 public 
  
 class 
  
 AddBucketIamMemberSample 
 { 
  
 public 
  
 Policy 
  
 AddBucketIamMember 
 ( 
  
 string 
  
 bucketName 
  
 = 
  
 "your-unique-bucket-name" 
 , 
  
 string 
  
 role 
  
 = 
  
 "roles/storage.objectViewer" 
 , 
  
 string 
  
 member 
  
 = 
  
 "serviceAccount:dev@iam.gserviceaccount.com" 
 ) 
  
 { 
  
 var 
  
 storage 
  
 = 
  
  StorageClient 
 
 . 
  Create 
 
 (); 
  
 var 
  
 policy 
  
 = 
  
 storage 
 . 
 GetBucketIamPolicy 
 ( 
 bucketName 
 , 
  
 new 
  
  GetBucketIamPolicyOptions 
 
  
 { 
  
 RequestedPolicyVersion 
  
 = 
  
 3 
  
 }); 
  
 // Set the policy schema version. For more information, please refer to https://cloud.google.com/iam/docs/policies#versions. 
  
 policy 
 . 
 Version 
  
 = 
  
 3 
 ; 
  
 Policy 
 . 
 BindingsData 
  
 bindingToAdd 
  
 = 
  
 new 
  
 Policy 
 . 
 BindingsData 
  
 { 
  
 Role 
  
 = 
  
 role 
 , 
  
 Members 
  
 = 
  
 new 
  
 List<string> 
  
 { 
  
 member 
  
 } 
  
 }; 
  
 policy 
 . 
 Bindings 
 . 
 Add 
 ( 
 bindingToAdd 
 ); 
  
 var 
  
 bucketIamPolicy 
  
 = 
  
 storage 
 . 
 SetBucketIamPolicy 
 ( 
 bucketName 
 , 
  
 policy 
 ); 
  
 Console 
 . 
 WriteLine 
 ( 
 $"Added {member} with role {role} " 
  
 + 
  
 $"to {bucketName}" 
 ); 
  
 return 
  
 bucketIamPolicy 
 ; 
  
 } 
 } 
 

  import 
  
 ( 
  
 "context" 
  
 "fmt" 
  
 "io" 
  
 "time" 
  
 "cloud.google.com/go/iam" 
  
 "cloud.google.com/go/storage" 
 ) 
 // addBucketIAMMember adds the bucket IAM member to permission role. 
 func 
  
 addBucketIAMMember 
 ( 
 w 
  
 io 
 . 
  Writer 
 
 , 
  
 bucketName 
  
 string 
 ) 
  
 error 
  
 { 
  
 // bucketName := "bucket-name" 
  
 ctx 
  
 := 
  
 context 
 . 
 Background 
 () 
  
 client 
 , 
  
 err 
  
 := 
  
 storage 
 . 
 NewClient 
 ( 
 ctx 
 ) 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 fmt 
 . 
 Errorf 
 ( 
 "storage.NewClient: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 defer 
  
 client 
 . 
 Close 
 () 
  
 ctx 
 , 
  
 cancel 
  
 := 
  
 context 
 . 
 WithTimeout 
 ( 
 ctx 
 , 
  
 time 
 . 
 Second 
 * 
 10 
 ) 
  
 defer 
  
 cancel 
 () 
  
 bucket 
  
 := 
  
 client 
 . 
  Bucket 
 
 ( 
 bucketName 
 ) 
  
 policy 
 , 
  
 err 
  
 := 
  
 bucket 
 . 
  IAM 
 
 (). 
 Policy 
 ( 
 ctx 
 ) 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 fmt 
 . 
 Errorf 
 ( 
 "Bucket(%q).IAM().Policy: %w" 
 , 
  
 bucketName 
 , 
  
 err 
 ) 
  
 } 
  
 // Other valid prefixes are "serviceAccount:", "user:" 
  
 // See the documentation for more values. 
  
 // https://cloud.google.com/storage/docs/access-control/iam 
  
 identity 
  
 := 
  
 "group:cloud-logs@google.com" 
  
 var 
  
 role 
  
 iam 
 . 
  RoleName 
 
  
 = 
  
 "roles/storage.objectViewer" 
  
 policy 
 . 
 Add 
 ( 
 identity 
 , 
  
 role 
 ) 
  
 if 
  
 err 
  
 := 
  
 bucket 
 . 
  IAM 
 
 (). 
 SetPolicy 
 ( 
 ctx 
 , 
  
 policy 
 ); 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 fmt 
 . 
 Errorf 
 ( 
 "Bucket(%q).IAM().SetPolicy: %w" 
 , 
  
 bucketName 
 , 
  
 err 
 ) 
  
 } 
  
 // NOTE: It may be necessary to retry this operation if IAM policies are 
  
 // being modified concurrently. SetPolicy will return an error if the policy 
  
 // was modified since it was retrieved. 
  
 fmt 
 . 
 Fprintf 
 ( 
 w 
 , 
  
 "Added %v with role %v to %v\n" 
 , 
  
 identity 
 , 
  
 role 
 , 
  
 bucketName 
 ) 
  
 return 
  
 nil 
 } 
 

  import 
  
 com.google.cloud. Binding 
 
 ; 
 import 
  
 com.google.cloud. Policy 
 
 ; 
 import 
  
 com.google.cloud.storage. Storage 
 
 ; 
 import 
  
 com.google.cloud.storage. StorageOptions 
 
 ; 
 import 
  
 java.util.ArrayList 
 ; 
 import 
  
 java.util.Arrays 
 ; 
 import 
  
 java.util.List 
 ; 
 public 
  
 class 
 AddBucketIamMember 
  
 { 
  
 /** Example of adding a member to the Bucket-level IAM */ 
  
 public 
  
 static 
  
 void 
  
 addBucketIamMember 
 ( 
  String 
 
  
 projectId 
 , 
  
  String 
 
  
 bucketName 
 ) 
  
 { 
  
 // The ID of your GCP project 
  
 // String projectId = "your-project-id"; 
  
 // The ID of your GCS bucket 
  
 // String bucketName = "your-unique-bucket-name"; 
  
 // For more information please read: 
  
 // https://cloud.google.com/storage/docs/access-control/iam 
  
  Storage 
 
  
 storage 
  
 = 
  
  StorageOptions 
 
 . 
 newBuilder 
 (). 
 setProjectId 
 ( 
 projectId 
 ). 
 build 
 (). 
 getService 
 (); 
  
  Policy 
 
  
 originalPolicy 
  
 = 
  
 storage 
 . 
  getIamPolicy 
 
 ( 
 bucketName 
 , 
  
 Storage 
 . 
 BucketSourceOption 
 . 
 requestedPolicyVersion 
 ( 
 3 
 )); 
  
  String 
 
  
 role 
  
 = 
  
 "roles/storage.objectViewer" 
 ; 
  
  String 
 
  
 member 
  
 = 
  
 "group:example@google.com" 
 ; 
  
 // getBindingsList() returns an ImmutableList and copying over to an ArrayList so it's mutable. 
  
 List<Binding> 
  
 bindings 
  
 = 
  
 new 
  
 ArrayList 
 ( 
 originalPolicy 
 . 
  getBindingsList 
 
 ()); 
  
 // Create a new binding using role and member 
  
  Binding 
 
 . 
 Builder 
  
 newMemberBindingBuilder 
  
 = 
  
  Binding 
 
 . 
 newBuilder 
 (); 
  
 newMemberBindingBuilder 
 . 
 setRole 
 ( 
 role 
 ). 
 setMembers 
 ( 
 Arrays 
 . 
 asList 
 ( 
 member 
 )); 
  
 bindings 
 . 
 add 
 ( 
 newMemberBindingBuilder 
 . 
 build 
 ()); 
  
 // Update policy to add member 
  
  Policy 
 
 . 
 Builder 
  
 updatedPolicyBuilder 
  
 = 
  
 originalPolicy 
 . 
  toBuilder 
 
 (); 
  
 updatedPolicyBuilder 
 . 
 setBindings 
 ( 
 bindings 
 ). 
 setVersion 
 ( 
 3 
 ); 
  
  Policy 
 
  
 updatedPolicy 
  
 = 
  
 storage 
 . 
  setIamPolicy 
 
 ( 
 bucketName 
 , 
  
 updatedPolicyBuilder 
 . 
 build 
 ()); 
  
 System 
 . 
 out 
 . 
 printf 
 ( 
 "Added %s with role %s to %s\n" 
 , 
  
 member 
 , 
  
 role 
 , 
  
 bucketName 
 ); 
  
 } 
 } 
 

  /** 
 * TODO(developer): Uncomment the following lines before running the sample. 
 */ 
 // The ID of your GCS bucket 
 // const bucketName = 'your-unique-bucket-name'; 
 // The role to grant 
 // const roleName = 'roles/storage.objectViewer'; 
 // The members to grant the new role to 
 // const members = [ 
 //   'user:jdoe@example.com', 
 //   'group:admins@example.com', 
 // ]; 
 // Imports the Google Cloud client library 
 const 
  
 { 
 Storage 
 } 
  
 = 
  
 require 
 ( 
 ' @google-cloud/storage 
' 
 ); 
 // Creates a client 
 const 
  
 storage 
  
 = 
  
 new 
  
 Storage 
 (); 
 async 
  
 function 
  
 addBucketIamMember 
 () 
  
 { 
  
 // Get a reference to a Google Cloud Storage bucket 
  
 const 
  
 bucket 
  
 = 
  
 storage 
 . 
 bucket 
 ( 
 bucketName 
 ); 
  
 // For more information please read: 
  
 // https://cloud.google.com/storage/docs/access-control/iam 
  
 const 
  
 [ 
 policy 
 ] 
  
 = 
  
 await 
  
 bucket 
 . 
  iam 
 
 . 
  getPolicy 
 
 ({ 
 requestedPolicyVersion 
 : 
  
 3 
 }); 
  
 // Adds the new roles to the bucket's IAM policy 
  
 policy 
 . 
  bindings 
 
 . 
 push 
 ({ 
  
 role 
 : 
  
 roleName 
 , 
  
 members 
 : 
  
 members 
 , 
  
 }); 
  
 // Updates the bucket's IAM policy 
  
 await 
  
 bucket 
 . 
  iam 
 
 . 
  setPolicy 
 
 ( 
 policy 
 ); 
  
 console 
 . 
 log 
 ( 
  
 `Added the following member(s) with role 
 ${ 
 roleName 
 } 
 to 
 ${ 
 bucketName 
 } 
 :` 
  
 ); 
  
 members 
 . 
 forEach 
 ( 
 member 
  
 = 
>  
 { 
  
 console 
 . 
 log 
 ( 
 ` 
 ${ 
 member 
 } 
 ` 
 ); 
  
 }); 
 } 
 addBucketIamMember 
 (). 
 catch 
 ( 
 console 
 . 
 error 
 ); 
 

  use Google\Cloud\Storage\StorageClient; 
 /** 
 * Adds a new member / role IAM pair to a given Cloud Storage bucket. 
 * 
 * @param string $bucketName The name of your Cloud Storage bucket. 
 *        (e.g. 'my-bucket') 
 * @param string $role The role to which the given member should be added. 
 *        (e.g. 'roles/storage.objectViewer') 
 * @param string[] $members The member(s) to be added to the role. 
 *        (e.g. ['group:example@google.com']) 
 */ 
 function add_bucket_iam_member(string $bucketName, string $role, array $members): void 
 { 
 $storage = new StorageClient(); 
 $bucket = $storage->bucket($bucketName); 
 $policy = $bucket->iam()->policy(['requestedPolicyVersion' => 3]); 
 $policy['version'] = 3; 
 $policy['bindings'][] = [ 
 'role' => $role, 
 'members' => $members 
 ]; 
 $bucket->iam()->setPolicy($policy); 
 printf('Added the following member(s) to role %s for bucket %s' . PHP_EOL, $role, $bucketName); 
 foreach ($members as $member) { 
 printf('    %s' . PHP_EOL, $member); 
 } 
 } 
 

  from 
  
 google.cloud 
  
 import 
  storage 
 
 def 
  
 add_bucket_iam_member 
 ( 
 bucket_name 
 , 
 role 
 , 
 member 
 ): 
  
 """Add a new member to an IAM Policy""" 
 # bucket_name = "your-bucket-name" 
 # role = "IAM role, e.g., roles/storage.objectViewer" 
 # member = "IAM identity, e.g., user: name@example.com" 
 storage_client 
 = 
  storage 
 
 . 
  Client 
 
 () 
 bucket 
 = 
 storage_client 
 . 
  bucket 
 
 ( 
 bucket_name 
 ) 
 policy 
 = 
 bucket 
 . 
 get_iam_policy 
 ( 
 requested_policy_version 
 = 
 3 
 ) 
 policy 
 . 
 bindings 
 . 
 append 
 ({ 
 "role" 
 : 
 role 
 , 
 "members" 
 : 
 { 
 member 
 }}) 
 bucket 
 . 
 set_iam_policy 
 ( 
 policy 
 ) 
 print 
 ( 
 f 
 "Added 
 { 
 member 
 } 
 with role 
 { 
 role 
 } 
 to 
 { 
 bucket_name 
 } 
 ." 
 ) 
 

  def 
  
 add_bucket_iam_member 
  
 bucket_name 
 : 
  
 # The ID of your GCS bucket 
  
 # bucket_name = "your-unique-bucket-name" 
  
 require 
  
 "google/cloud/storage" 
  
 storage 
  
 = 
  
 Google 
 :: 
 Cloud 
 :: 
  Storage 
 
 . 
  new 
 
  
 bucket 
  
 = 
  
 storage 
 . 
 bucket 
  
 bucket_name 
  
 role 
  
 = 
  
 "roles/storage.objectViewer" 
  
 member 
  
 = 
  
 "group:example@google.com" 
  
 bucket 
 . 
  policy 
 
  
 requested_policy_version 
 : 
  
 3 
  
 do 
  
 | 
 policy 
 | 
  
 policy 
 . 
  bindings 
 
 . 
  insert 
 
  
 role 
 : 
  
 role 
 , 
  
 members 
 : 
  
 [ 
 member 
 ] 
  
 end 
  
 puts 
  
 "Added 
 #{ 
 member 
 } 
 with role 
 #{ 
 role 
 } 
 to 
 #{ 
 bucket_name 
 } 
 " 
 end