Google Cloud CreateBucketIamPolicy
CertifiedAdd IAM binding to a GCS bucket
Google Cloud CreateBucketIamPolicy
Add IAM binding to a GCS bucket
Adds a role/member binding to a bucket policy. Can error or skip when the binding already exists.
type: io.kestra.plugin.gcp.gcs.CreateBucketIamPolicyExamples
Add role to a service account on a bucket
id: gcp_gcs_create_bucket_iam_policy
namespace: company.team
tasks:
- id: create_bucket_iam_policy
type: io.kestra.plugin.gcp.gcs.CreateBucketIamPolicy
name: "my-bucket"
member: "serviceAccount:sa@project.iam.gserviceaccount.com"
role: "roles/storage.admin"
Properties
member *string
Member
IAM member string, e.g., user: alice@example.com or serviceAccount: sa@project.iam.gserviceaccount.com
name *string
Bucket name
role *string
Role
IAM role to grant (e.g., roles/storage.objectViewer)
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150ifExists string
SKIPERRORSKIPExisting binding policy
ERROR or SKIP when the role/member already exists; default SKIP
impersonatedServiceAccount string
The GCP service account to impersonate
projectId string
The GCP project ID
scopes array
["https://www.googleapis.com/auth/cloud-platform"]The GCP scopes to be used
serviceAccount string
The GCP service account
Outputs
bucket string
Bucket name
created boolean
Created
True if the binding was added; false if it already existed
member string
Member
role string
Role
