Google Cloud Storage (GCS) CreateBucketIamPolicy

Google Cloud Storage (GCS) CreateBucketIamPolicy
Certified
Add IAM binding to a GCS bucket

Adds a role/member binding to a bucket policy. Can error or skip when the binding already exists.

yaml
type: io.kestra.plugin.gcp.gcs.CreateBucketIamPolicy

Examples

Add role to a service account on a bucket

yaml
id: gcp_gcs_create_bucket_iam_policy
namespace: company.team

tasks:
  - id: create_bucket_iam_policy
    type: io.kestra.plugin.gcp.gcs.CreateBucketIamPolicy
    name: "my-bucket"
    member: "serviceAccount:sa@project.iam.gserviceaccount.com"
    role: "roles/storage.admin"

Installation

Our standard Docker images already include this plugin. If you use a -slim image or another setup, install it with the following command:

kestractl plugins get io.kestra.plugin:plugin-gcp --compatible-for $KESTRA_VERSION

For kestractl, use your Kestra version with --compatible-for, or specify an exact plugin version.

For Kestra CLI, replace LATEST with a specific version or version range to pin the plugin version.

Properties

member *string

Member

IAM member string, e.g., user: alice@example.com or serviceAccount: sa@project.iam.gserviceaccount.com

name *string

Bucket name

role *string

Role

IAM role to grant (e.g., roles/storage.objectViewer)

assets

Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.

Definitions

io.kestra.core.models.assets.AssetsDeclaration

assetFailureBehaviorstring

Possible Values

IGNOREFAILWARN

Asset failure behavior

Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.

enableAutobooleanstring

Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.

inputsarray

The assets consumed as inputs.

io.kestra.core.models.assets.AssetIdentifier

id*string

Min length1

typestring

outputs

The assets produced as outputs.

io.kestra.plugin.ee.assets.Dataset

id*string

Min length1

Max length150

type*object

descriptionstring

displayNamestring

metadataobject

Default{}

namespacestring

Min length1

Max length150

io.kestra.plugin.ee.assets.File

id*string

Min length1

Max length150

type*object

descriptionstring

displayNamestring

metadataobject

Default{}

namespacestring

Min length1

Max length150

io.kestra.plugin.ee.assets.Table

id*string

Min length1

Max length150

type*object

descriptionstring

displayNamestring

metadataobject

Default{}

namespacestring

Min length1

Max length150

io.kestra.plugin.ee.assets.VM

id*string

Min length1

Max length150

type*object

descriptionstring

displayNamestring

metadataobject

Default{}

namespacestring

Min length1

Max length150

io.kestra.core.models.assets.External

id*string

Min length1

Max length150

type*object

descriptionstring

displayNamestring

metadataobject

Default{}

namespacestring

Min length1

Max length150

io.kestra.core.models.assets.Custom

id*string

Min length1

Max length150

type*string

Min length1

Custom asset type

descriptionstring

displayNamestring

metadataobject

Default{}

namespacestring

Min length1

Max length150

ifExists string

DefaultSKIP

Possible Values

ERRORSKIP

Existing binding policy

ERROR or SKIP when the role/member already exists; default SKIP

impersonatedServiceAccount string

The GCP service account to impersonate

projectId string

The GCP project ID

scopes array

SubTypestring

Default["https://www.googleapis.com/auth/cloud-platform"]

The GCP scopes to be used

serviceAccount string

The GCP service account

When unset or rendered to an empty value, Application Default Credentials are used (e.g. GOOGLE_APPLICATION_CREDENTIALS or the runtime's attached identity).

workloadIdentityAudience string

Audience of the Workload Identity Federation provider

The full resource name of the workload identity pool provider, //iam.googleapis.com/projects/<number>/locations/global/workloadIdentityPools/<pool>/providers/<provider>. Required with workloadIdentityToken, and must match the aud claim of the token.

workloadIdentityToken string

OIDC token for Workload Identity Federation

When set together with workloadIdentityAudience, the token is exchanged at Google STS for federated credentials and no service account key is needed: Google verifies it against the identity provider that issued it. Use {{ oidcToken(audience='…') }} to have Kestra Enterprise mint one for the running execution. Combine with impersonatedServiceAccount to act as a service account the pool may impersonate, and set projectId explicitly since no key file carries it. Cannot be combined with serviceAccount.

Outputs

bucket string

Bucket name

created boolean

Created

True if the binding was added; false if it already existed

member string

Member

role string

Role