Storage Transfer Service uses Identity and Access Management (IAM) permissions and roles to control who can access Storage Transfer Service resources. The main types of resources available in Storage Transfer Service are jobs, operations, and agent pools. In the IAM policy hierarchy, jobs are child resources of projects, and operations are child resources of jobs.
To grant access to a resource, you assign one or more permissions or roles to a user, group, or a service account.
Permissions
You can grant the following Storage Transfer Service permissions:
Transfer project permission
| Permission | Description |
|---|---|
storagetransfer.projects.getServiceAccount |
Can read the GoogleServiceAccount used by the Storage Transfer Service to access Cloud Storage buckets. |
Transfer job permissions
The following table describes permissions for Storage Transfer Service jobs:
| Permission | Description |
|---|---|
storagetransfer.jobs.create |
Can create new transfer jobs. |
storagetransfer.jobs.delete |
Can delete existing transfer jobs. Transfer jobs are deleted by calling the patch function. However, users must have this permission when deleting transfer jobs to avoid permission errors. |
storagetransfer.jobs.get |
Can retrieve specific jobs. |
storagetransfer.jobs.list |
Can list all transfer jobs. |
storagetransfer.jobs.run |
Can run all transfer jobs. |
storagetransfer.jobs.update |
Can update transfer job configurations without deleting them. |
Transfer operations permissions
The following table describes permissions for Storage Transfer Service operations:
| Permission | Description |
|---|---|
storagetransfer.operations.assign |
Used by transfer agents to assign operations. Not supported in custom roles; grant the predefined roles/storagetransfer.transferAgent role instead. |
storagetransfer.operations.cancel |
Can cancel transfer operations. |
storagetransfer.operations.get |
Can get details of transfer operations. |
storagetransfer.operations.list |
Can list all transfer job operations. |
storagetransfer.operations.pause |
Can pause transfer operations. |
storagetransfer.operations.report |
Used by transfer agents to report operation status. Not supported in custom roles; grant the predefined roles/storagetransfer.transferAgent role instead. |
storagetransfer.operations.resume |
Can resume paused transfer operations. |
Transfer agent pool permissions
The following table describes permissions for transfer agent pools:
| Permission | Description |
|---|---|
storagetransfer.agentpools.create |
Can create agent pools and configure bandwidth limits. |
storagetransfer.agentpools.update |
Can update agent pools and bandwidth limits. |
storagetransfer.agentpools.delete |
Can delete agent pools. |
storagetransfer.agentpools.get |
Can get information and bandwidth limits for specific agent pools. |
storagetransfer.agentpools.list |
Can list information and bandwidth limits for all agent pools in the project. |
storagetransfer.agentpools.report |
Used by transfer agents to report status. Not supported in custom roles; grant the predefined roles/storagetransfer.transferAgent role instead. |
Predefined roles
This section describes the predefined roles for Storage Transfer Service. Roles are the preferred way of setting IAM permissions.
Role comparison
You can assign the following Storage Transfer Service predefined roles to principals:
| Capability | Storage Transfer Admin ( roles/storagetransfer.admin) |
Storage Transfer User ( roles/storagetransfer.user) |
Storage Transfer Viewer ( roles/storagetransfer.viewer) |
|---|---|---|---|
| List and get jobs | |||
| Create and configure jobs | |||
| Run and update jobs | |||
| Delete jobs | |||
| List and get transfer operations | |||
| Pause, resume, and cancel transfer operations | |||
| Read Storage Transfer Service service account details | |||
| List and get agent pools | |||
| Create and update agent pools | |||
| Delete agent pools | |||
| Set agent pool bandwidth limits |
Role details
The following table describes in detail the predefined roles for Storage Transfer Service:
| Role | Description | Included Permissions |
|---|---|---|
|
Storage Transfer Admin ( roles/storagetransfer.admin)
|
Provides full administrative access to all Storage Transfer Service resources, including creating, updating, running, and deleting transfer jobs and agent pools. |
|
|
Storage Transfer User ( roles/storagetransfer.user)
|
Provides permissions to create, get, update, and run transfer jobs and agent pools within the project. Cannot delete transfer jobs or agent pools, preserving a complete audit record of past transfers. |
|
|
Storage Transfer Viewer ( roles/storagetransfer.viewer)
|
Provides read-only access to view and list transfer jobs, operations, and agent pools within the project. Cannot create, run, update, or delete transfers. |
|
Storage Transfer Agent
(roles/storagetransfer.transferAgent)
|
Gives transfer agents the Storage Transfer Service permissions required to complete a transfer. As of May 1, 2024, Grant this role to the user or service account being used by agents. |
|
Storage Transfer Service Agent
(roles/storagetransfer.serviceAgent)
|
Gives the Storage Transfer Service service agent the permissions required to create and modify Pub/Sub topics to communicate from Google Cloud to transfer agents. Grant this role to the Storage Transfer Service service agent. |
|
Custom roles
You can create and apply custom IAM roles to meet your organization's access requirements.
When creating custom roles, we recommend using a combination of predefined roles to ensure that the correct permissions are included together.
The Google Cloud console will not work properly if the custom role is missing required permissions. For example, some parts of the Google Cloud console assume a role has read access to display an item before editing it, so a role with only write permissions may encounter Google Cloud console screens that don't work.