title: GCP - Controlling access to Service Account for Google Cloud Storage
body: <p>I am trying to upload a file using @google-cloud/storage client from Node.js.
  I have successfully created a Service Account with the role that gives it right to create (upload), delete (reupload the object with same name) and download an object on Cloud Storage.
  This has been made possible due to the Storage Object Admin role.</p>
  
  <p>When I assigned the Storage Object Creator role, I was not able to upload an image with the same name to the Storage.</p>
  
  <p>What I actually require is, I need to give the upload and delete rights but not the download rights to the Node.js client.</p>
  
  <p>It would also be great if there would be a way to only allow .jpg files to be uploaded. I tried to add conditions with the credentials, but that did not help.</p>