To run Cloud Storage MCP server methods, you need specific Identity and Access Management (Identity and Access Management) permissions. This document lists the permissions required for each method.
You can manage access to your Cloud Storage resources by granting roles to users and groups. Each role contains specific permissions. You can use these permissions to configure access control for your MCP server methods.
| Method | Required IAM Permissions |
|---|---|
create_bucket |
mcp.tools.callstorage.buckets.create |
delete_bucket |
mcp.tools.callstorage.buckets.delete |
delete_object |
mcp.tools.callstorage.objects.delete |
get_object_metadata |
mcp.tools.callstorage.objects.get |
list_buckets |
mcp.tools.callstorage.buckets.list |
list_objects |
mcp.tools.callstorage.objects.list |
read_object |
mcp.tools.callstorage.objects.get |
write_text |
mcp.tools.callstorage.objects.create |
What's next
For a list of roles and the permissions they contain, see IAM Roles for Cloud Storage.
Assign IAM roles at the project and bucket level.