Overview

When connecting your Google Cloud Storage (GCS) buckets to Cloney for data migration, it's essential to follow the principle of least privilege. This guide walks you through creating a service account with only the permissions necessary for Cloney to read from or write to your GCS buckets.

Security Best Practice

Always use dedicated service accounts with minimal IAM roles. Never use owner or editor roles for migration tasks.

Prerequisites

  • A Google Cloud account with Owner or IAM Admin access
  • A GCP project with Cloud Storage enabled
  • The name of the GCS bucket(s) you want to connect
  • Knowledge of whether you need read-only (source) or write (destination) access

Step 1: Access the IAM Console

  1. Sign in to the Google Cloud Console
  2. Select your project from the project dropdown
  3. Navigate to IAM & Admin → Service Accounts
  4. Click Create Service Account

Step 2: Create a Service Account

  1. Enter a descriptive name (e.g., cloney-migration-sa)
  2. Add a description: "Service account for Cloney cloud migration"
  3. Click Create and Continue
  4. Skip the "Grant this service account access to project" step for now (we'll set bucket-level permissions)
  5. Click Done

Step 3: Set Bucket-Level Permissions (Source - Read Only)

If your GCS bucket will be used as a source for migration, grant these permissions:

  1. Go to Cloud Storage → Buckets
  2. Click on your source bucket name
  3. Go to the Permissions tab
  4. Click Grant Access
  5. Enter your service account email (e.g., cloney-migration-sa@your-project.iam.gserviceaccount.com)
  6. Assign the role: Storage Object Viewer (roles/storage.objectViewer)
  7. Click Save
Role Explanation

Storage Object Viewer grants storage.objects.get and storage.objects.list permissions - exactly what's needed to read objects.

Step 4: Set Bucket-Level Permissions (Destination - Write)

If your GCS bucket will be used as a destination for migration, grant these permissions:

  1. Go to Cloud Storage → Buckets
  2. Click on your destination bucket name
  3. Go to the Permissions tab
  4. Click Grant Access
  5. Enter your service account email
  6. Assign the role: Storage Object Admin (roles/storage.objectAdmin)
  7. Click Save
Note

Storage Object Admin is required for write operations. It grants create, delete, and overwrite permissions on objects within the bucket only.

Step 5: Generate Service Account Key

  1. Go back to IAM & Admin → Service Accounts
  2. Click on the service account you created
  3. Go to the Keys tab
  4. Click Add Key → Create new key
  5. Select JSON as the key type
  6. Click Create
  7. The JSON key file will be downloaded automatically - store it securely
Ready to Connect

You can now use this JSON key file in Cloney to connect your Google Cloud Storage bucket securely.

Alternative: Custom IAM Role

For even more granular control, create a custom IAM role with specific permissions:

YAML - Custom Role Definition
title: "Cloney Migration Role"
description: "Custom role for Cloney cloud migration"
stage: "GA"
includedPermissions:
  # For source buckets (read)
  - storage.objects.get
  - storage.objects.list
  - storage.buckets.get
  # For destination buckets (write) - add these if needed
  - storage.objects.create
  - storage.objects.delete
  - storage.multipartUploads.create
  - storage.multipartUploads.abort
  - storage.multipartUploads.listParts

Permission Reference

PermissionPurposeRequired For
storage.objects.getRead object dataSource
storage.objects.listList bucket contentsSource & Destination
storage.buckets.getGet bucket metadataSource & Destination
storage.objects.createWrite new objectsDestination
storage.objects.deleteDelete/overwrite objectsDestination
storage.multipartUploads.*Handle large file uploadsDestination