Access Mapping

The Ranger GCS plugin maps Ranger access types to Google Cloud IAM permissions and predefined roles as follows:

Access Type in Ranger UI	Google Cloud IAM Permission	Predefined Role	Scope
`BucketsList`, `BucketsGet`	`storage.buckets.list`, `storage.buckets.get`	`roles/storage.legacyBucketReader`	Bucket metadata
`ObjectsList`, `ObjectsGet`	`storage.objects.list`, `storage.objects.get`	`roles/storage.objectViewer`	List objects and read object content
`ObjectsCreate`	`storage.objects.create`	`roles/storage.objectCreator`	Create or upload objects
`ObjectsDelete`	`storage.objects.delete`	`roles/storage.legacyObjectOwner`	Delete objects

Ranger groups are not translated to Google Cloud identities in the current implementation.

Ranger roles are also not translated to Google Cloud IAM roles because Ranger roles and Google Cloud IAM roles are separate concepts.

Last updated on Aug 31, 2026

Was this page helpful?