While Cloud Storage IAM policies may be applied at the project and bucket level, they cannot be applied to specific objects or sets of objects. This is where ACLs come in handy. ACLs can be applied at the object level or bucket level, and are composed of one or more sets of scopes and permissions.
Any single bucket or object may have up to 100 ACLs:
- Scopes specify who the policy will apply to. Similar to the grantee of IAM policies, scopes may be provided as an individual email address, a G Suite or Cloud Identity domain, or a Google group. Additionally, the special identifiers, allAuthenticatedUsers and allUsers, grant access to all Google accounts and all users in general, respectively.
- Permissions are defined as one of OWNER, WRITER ...
