Repository navigation
Blob IAM support apparently invalid #4087
Description
While writing system tests for the requester_pays feature, I triggered the following:
Traceback (most recent call last):
File "/home/tseaver/projects/agendaless/Google/src/google-cloud-python/storage/tests/system.py", line 372, in test_blob_acl_iam_w_user_project
blob.set_iam_policy(policy)
File "/home/tseaver/projects/agendaless/Google/src/google-cloud-python/storage/google/cloud/storage/blob.py", line 1148, in set_iam_policy
_target_object=None)
File "/home/tseaver/projects/agendaless/Google/src/google-cloud-python/storage/.nox/sys-3-6/lib/python3.6/site-packages/google/cloud/_http.py", line 293, in api_request
raise exceptions.from_http_response(response)
google.api.core.exceptions.BadRequest: 400 PUT https://www.googleapis.com/storage/v1/b/new_1506705016579/o/SmallFile/iam?userProject=citric-celerity-697: roles/storage.objectViewer is not a valid role for projects/_/buckets/new_1506705016579/objects/SmallFile#0.Note that the earlier call to Blob.get_iam_policy does succeed, returning:
(Pdb) pp policy.to_api_repr()
{'bindings': [{'members': ['projectEditor:some-project-742',
'projectOwner:some-project-742',
'serviceAccount:1065521786570-19reuv03qbdp37du41inh9gtd1s35g1j@developer.gserviceaccount.com'],
'role': 'roles/storage.legacyObjectOwner'},
{'members': ['projectViewer:some-project-742'],
'role': 'roles/storage.legacyObjectReader'},
{'members': ['allUsers'], 'role': 'roles/storage.objectViewer'}],
'etag': 'CAM='}We don't have existing system tests for Blob.set_iam_policy, but the Storage IAM docs don't define any IAM operations for blobs, only for buckets and projects. Indeed, they say:
To learn about controlling access to individual objects in your buckets, see Access Control Lists.
The API documentation for Objects also doesn't (any longer?) show getIamPolicy, setIamPolicy, or testIamPermissions.
@lukesneeringer can you loop somebody in to clarify?
Activity
tseaver commentedon Sep 29, 2017
@frankyn confirmed to me offline:
tseaver commentedon Sep 29, 2017
It turns out that
Blob.set_iam_policycan only assign the following "legacy" roles:roles/storage.legacyObjectReaderroles/storage.legacyObjectOwnerfrankyn commentedon Oct 18, 2017
IAM object-level methods should not be deprecated. We should document how to use these methods to assign legacy roles instead.
tseaver commentedon Oct 20, 2017
@frankyn ISTM that the back-end docs need to be updated correspondingly (and first, so that we track them without guesswork).
frankyn commentedon Oct 23, 2017
Good point. I'm working on resolving this in Storage docs. I'll update this issue.
tseaver commentedon Jan 4, 2018
@frankyn ping?
frankyn commentedon Jan 5, 2018
frankyn commentedon Jan 10, 2018
@tseaver docs were blocked by an internal bug and I will check-in again this week. Apologies for the delay.
tseaver commentedon Feb 20, 2018
@frankyn I still don't see API documentation for
objects.getIamPermissionset. al.frankyn commentedon Feb 20, 2018
Will update soon. I need to sync with a few stakeholders on the GCS team before continuing there exist additional open questions before introducing the docs back into the world. Setting up meeting for mid-next week given some are OOO. I will have a better update then. Thank you for patience.
frankyn commentedon Feb 22, 2018
Sent a document for GCS team review to determine consensus for what to do here.
tseaver commentedon Apr 11, 2018
@frankyn ping?
frankyn commentedon Apr 11, 2018
Hey @tseaver, responding through hangouts.
Replace link to 404 object IAM docs with a note on limited utility. (#…
Replace link to 404 object IAM docs with a note on limited utility. (#…