<p>I have a container running within GCE kubernetes engine which is trying to copy some data from a bucket to a mounted persistent disk:</p>

<pre><code>gsutil -m rsync -r -d "gs://${DB_BUCKET}/db" /db
</code></pre>

<p>When the container runs, it fails with the following message:</p>

<pre><code>AccessDeniedException: 403 xxx-service@my-project.iam.gserviceaccount.com does not have storage.objects.list access to my-bucket-db-data
</code></pre>

<p>If I look at the service account, it does appear to have permissions to view storage buckets.  I create a populate this bucket as part of my deployment process if that makes any difference.</p>

<p>What permissions do I need to grant/how to be able to sync the data from the bucket across?</p>

<p>You need to add referred permission to <code>xxx-service@my-project.iam.gserviceaccount.com</code>:</p>

<p>Follow this steps:</p>

<p>1) Access <em>Permissions</em> tab into ${DB_BUCKET}</p>

<p>2) Search for your service account in the search input field</p>

<p>3) In the <em>Role(s)</em> column find "Storage Object Viewer" role</p>
