To run Cloud Storage MCP server methods, you need access to the target Cloud Storage resources. You manage access control by granting Identity and Access Management (IAM) roles to principals, such as users, groups, and service accounts. Each role contains a set of permissions. If you want to create custom roles with specific permissions, this document lists the permissions that are required for each MCP server method.
| Method | Required IAM Permissions |
|---|---|
create_bucket |
mcp.tools.callstorage.buckets.create |
delete_bucket |
mcp.tools.callstorage.buckets.delete |
delete_object |
mcp.tools.callstorage.objects.delete |
get_object_metadata |
mcp.tools.callstorage.objects.get |
list_buckets |
mcp.tools.callstorage.buckets.list |
list_objects |
mcp.tools.callstorage.objects.list |
read_object |
mcp.tools.callstorage.objects.get |
write_text |
mcp.tools.callstorage.objects.create |
What's next
Learn about IAM for Cloud Storage.
For a list of predefined roles and the permissions that they contain, see IAM roles for Cloud Storage.
Grant IAM roles at the project and bucket level.