Prerequisites

Ranger Requirements

Ensure that:

• The Ranger Admin host can access Google OAuth and Cloud Storage API endpoints.
• A Google Cloud service account credential file is accessible to the Ranger Admin process, or Application Default Credentials (ADC) are configured.

Google Cloud Requirements

Ensure that you have:

• A Google Cloud project.
• One or more GCS buckets.
• A service account that Ranger Admin can use to inspect and update bucket IAM policies.
• The required permissions assigned to the service account.

The service account must have permissions to:

• Read bucket metadata.
• List buckets for resource lookup.
• List objects for object lookup.
• Read bucket IAM policies.
• Update bucket IAM policies.

The predefined roles/storage.admin role provides the required permissions but grants broad access.

For production environments, use a custom role that contains only the required permissions. For example:

storage.buckets.get
storage.buckets.list
storage.buckets.getIamPolicy
storage.buckets.setIamPolicy
storage.objects.list

Grant the permissions only at the required project or bucket scope.