Stay organized with collectionsSave and categorize content based on your preferences.
This page shows you how to make objects you own readable to everyone on
the public internet. To learn how to access data that has been made public, seeAccessing Public Data.
When an object is shared publicly, any user with knowledge of the
object URI can access the object for as long as the object is public.
Required roles
In order to get the required permissions for making objects publicly readable,
ask your administrator to grant you the following roles for the bucket that
contains the data you want to make public:
To make all objects in a bucket publicly readable: Storage Admin
(roles/storage.admin)
To make individual objects publicly readable: Storage Object Admin
(roles/storage.objectAdmin)
If you plan on using the Google Cloud console, you'll need the
Storage Admin (roles/storage.admin) role instead of the Storage Object
Admin role.
These roles contain the permissions required to make objects public. To see the
exact permissions that are required, expand theRequired permissionssection:
Required permissions
storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.buckets.update
storage.objects.get
storage.objects.getIamPolicy
storage.objects.setIamPolicy
storage.objects.update
The following permissions are only required for using the
Google Cloud console to perform the tasks on this page:
To make all objects in a bucket readable to everyone on the public internet,
grant the principalallUsersthe Storage Object Viewer
(roles/storage.objectViewer) role:
Console
In the Google Cloud console, go to the Cloud StorageBucketspage.
In the list of buckets, click the name of the bucket that you want to
make public.
Select thePermissionstab near the top of the page.
In thePermissionssection, click theperson_addGrant accessbutton.
TheGrant accessdialog appears.
In theNew principalsfield, enterallUsers.
In theSelect a roledrop down, enterStorage Object Viewerin
the filter box and select theStorage Object Viewerfrom the
filtered results.
ClickSave.
ClickAllow public access.
Once public access has been granted,Copy URLappears for each object in
thepublic accesscolumn. You can click this button to get the public URL
for the object.
To learn how to get detailed error information about failed Cloud Storage
operations in the Google Cloud console, seeTroubleshooting.
Command line
In the Google Cloud console, activate Cloud Shell.
At the bottom of the Google Cloud console, aCloud Shellsession starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
using Google.Apis.Storage.v1.Data;
using Google.Cloud.Storage.V1;
using System;
using System.Collections.Generic;
public class MakeBucketPublicSample
{
public void MakeBucketPublic(string bucketName = "your-unique-bucket-name")
{
var storage = StorageClient.Create();
Policy policy = storage.GetBucketIamPolicy(bucketName);
policy.Bindings.Add(new Policy.BindingsData
{
Role = "roles/storage.objectViewer",
Members = new List<string> { "allUsers" }
});
storage.SetBucketIamPolicy(bucketName, policy);
Console.WriteLine(bucketName + " is now public ");
}
}
/**
* TODO(developer): Uncomment the following lines before running the sample.
*/
// The ID of your GCS bucket
// const bucketName = 'your-unique-bucket-name';
// Imports the Google Cloud client library
const {Storage} = require('@google-cloud/storage');
// Creates a client
const storage = new Storage();
async function makeBucketPublic() {
await storage.bucket(bucketName).makePublic();
console.log(`Bucket ${bucketName} is now publicly readable`);
}
makeBucketPublic().catch(console.error);
def set_bucket_public_iam bucket_name:
# The ID of your GCS bucket
# bucket_name = "your-unique-bucket-name"
require "google/cloud/storage"
storage = Google::Cloud::Storage.new
bucket = storage.bucket bucket_name
bucket.policy do |p|
p.add "roles/storage.objectViewer", "allUsers"
end
puts "Bucket #{bucket_name} is now publicly readable"
end
# Make bucket public
resource "google_storage_bucket_iam_member" "member" {
provider = google
bucket = google_storage_bucket.default.name
role = "roles/storage.objectViewer"
member = "allUsers"
}
JSON_FILE_NAMEis the path for the file
that you created in Step 2.
BUCKET_NAMEis the name of the bucket
whose objects you want to make public. For example,my-bucket.
XML API
Making all objects in a bucket publicly readable is not supported by
the XML API. Use the Google Cloud console orgcloud storage.
Make a portion of a bucket publicly readable
Use amanaged folderto control access to objects whose name prefix match
the name of the managed folder. For example, a managed folder namedmy-foldercan be used to control access to objects namedmy-folder/cats.jpgandmy-folder/dogs.jpg.
To make such objects publicly accessible, first create the managed folder, and
then set an IAM policy on the folder that grantsallUsersthe
Storage Object Viewer (roles/storage.objectViewer) role:
Console
In the Google Cloud console, go to the Cloud StorageBucketspage.
Click the name of the bucket that contains the objects you want to
make public.
Create a folder, using the following steps:
Click theCreate folderbutton.
Enter theNamefor the folder. Once the folder is converted to a
managed folder, objects whose name start with this name will be
subject to IAM roles set on the folder.
ClickCreate.
Convert the folder to a managed folder, using the following steps:
In the pane that shows the bucket's contents, find the name of the
folder you created, and click theMore optionsiconmore_vert.
ClickEdit access.
In the window that appears, clickEnable.
Add an IAM policy to the folder that grantsallUsersthe
Storage Object Viewer (roles/storage.objectViewer) role, using the
following steps:
If thePermissionspane for your managed folder isn't already
open, click theMore optionsiconmore_vertfor the managed
folder, and then clickEdit access.
In thePermissionspane, click theperson_addAdd principalbutton.
In theNew principalsfield, enterallUsers.
In theSelect a roledrop down, enterStorage Object Viewerin the filter box, and selectStorage Object Viewerfrom the
filtered results.
ClickSave.
ClickAllow public access.
Once public access has been granted,Copy URLappears for each
applicable object in thepublic accesscolumn. You can click this button
to get the public URL for the object.
To learn how to get detailed error information about failed Cloud Storage
operations in the Google Cloud console, seeTroubleshooting.
Command line
In the Google Cloud console, activate Cloud Shell.
At the bottom of the Google Cloud console, aCloud Shellsession starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
JSON_FILE_NAMEis the path for the file
that you created in the previous step.
BUCKET_NAMEis the name of the bucket
containing the managed folder you're adding the IAM
policy to. For example,my-bucket.
MANAGED_FOLDER_NAMEis the name of the
managed folder you're adding the IAM policy to.
For example,my-managed-folder.
XML API
The XML API does not support working with managed folders. Use a
different tool, such as the Google Cloud console, or set ACLs on
individual objects usingSet Object ACLrequests. The following
is an example ACL file the would grantallUsersaccess to an object: