Cloud Read/Write Permissions for GCS
- Capella Analytics
- reference
This page outlines the required read and write permissions when copying data to or from external cloud providers.
Exclusive permissions are required when reading from cloud storage using External Collections or writing to cloud storage using COPY TO statements.
Prerequisites
Before granting permissions, ensure you have the following:
-
A Google Cloud Platform (GCP) account with the necessary administrative privileges.
-
Access to the Google Cloud Console.
-
The name of the GCS bucket you want to access.
Read Permissions
You need Read permissions when reading from cloud storage using External Collections.
To grant read permissions to your GCP cloud storage:
Create a Role
To create a new role with the required read permissions:
-
Go to the Google Cloud console.
-
From the Dashboard, go to IAM and Admin and select Roles.
-
Select Create Role.
-
Fill in the information (Title, Description, … etc).
-
Select Add Permissions.
-
Select the following permissions:
-
storage.objects.get -
storage.objects.list
-
-
Select Add.
-
Select Create.
Add the Role to the Bucket
Add the Google Cloud Platform (GCP) Service Account you want to use with Capella Analytics to the bucket and assign it the role you created:
-
Go to the Google Cloud console.
-
From the Dashboard, go to Cloud Storage and select Buckets.
-
Select the desired bucket.
-
From the Bucket page, select the Permissions tab.
-
Under View by Principals, select Grant Access.
-
Under Add Principal, add the desired Service Account.
-
Under Assign Roles, select the Role created in the previous steps.
Read and Write Permissions
Read and write permissions are needed when writing to cloud storage using COPY TO statements. To grant read and write permissions to your GCP cloud storage:
Create a Role
To create a new role with the required read and write permissions:
-
Go to the Google Cloud console.
-
From the Dashboard, go to IAM and Admin and select Roles.
-
Select Create Role.
-
Fill in the information (Title, Description, … etc).
-
Select Add Permissions.
-
Select the following permissions:
-
storage.objects.get -
storage.objects.list -
storage.objects.create -
storage.objects.delete
-
-
Select Add.
-
Select Create.
Add the Role to the Bucket
Next, add the Google Cloud Platform (GCP) Service Account to the bucket and assign it the created role:
-
Go to the Google Cloud console.
-
From the Dashboard, go to Cloud Storage and select Buckets.
-
Select the desired bucket.
-
From the Bucket page, select the Permissions tab.
-
Under View by Principals, select Grant Access.
-
Under Add Principal, add the desired Service Account.
-
Under Assign Roles, select the Role created in the previous steps.