Prerequisites

Ranger Requirements

Ensure that:

• The Ranger Admin host can access Google OAuth and Cloud Storage API endpoints.

• A Google Cloud service account credential file is accessible to the Ranger Admin process, or Application Default Credentials (ADC) are configured.

Google Cloud Requirements

Ensure that you have:

• A Google Cloud project.

• One or more GCS buckets.

• A service account that Ranger Admin can use to inspect and update bucket IAM policies.

• The required permissions assigned to the service account.

The service account must have permissions to:

• Read bucket metadata.

• List buckets for resource lookup.

• List objects for object lookup.

• Read bucket IAM policies.

• Update bucket IAM policies.

The predefined roles/storage.admin role provides the required permissions but grants broad access.

For production environments, use a custom role that contains only the required permissions. For example:

Grant the permissions only at the required project or bucket scope.