403: does not have storage.objects.get access Google Cloud / Firebase Origin: Platform & cloud Last updated 4 Nov 2026

Cloud Storage: 403 Forbidden — user@example.com does not have storage.objects.get access to the Google Cloud Storage object

The identity making the request has no read permission on that bucket or object.

Exact message you may see does not have storage.objects.get access to the Google Cloud Storage object403 Forbidden storage.objects.getAccessDeniedException: 403 does not have storage.objects.list access to the Google Cloud Storage bucketAnonymous caller does not have storage.objects.get accessstorage.buckets.get permission denied
Explore the map of this error Full error map →
Seen on: Google Cloud

Meaning

Grant roles/storage.objectViewer (read) or objectAdmin on the bucket to the right principal. With uniform bucket-level access, object ACLs no longer work. Public access also needs allUsers plus public-access-prevention disabled. Note signed-in browser accounts may differ from the service account your app uses.

Common causes

  • Missing objectViewer/objectUser role
  • Uniform bucket-level access ignoring ACLs
  • Public access prevention enforced
  • Wrong service account in the app
  • Requester pays or different project

⚡ Quick fix

  1. gsutil iam ch serviceAccount:SA:objectViewer gs://BUCKET
  2. Check the active identity
  3. For public files, allow allUsers objectViewer (if policy permits)

Detailed fix by platform

gcloud

  1. gcloud storage buckets add-iam-policy-binding gs://BUCKET --member=serviceAccount:SA@PROJECT.iam.gserviceaccount.com --role=roles/storage.objectViewer

How to diagnose

  1. Identity — Which principal?
  2. Role — objectViewer?
  3. Policy — Public access prevention?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

BigQuery: Access Denied: Project: User does not have bigquery.jobs.create permission — BigQuery: Access Denied: Project my-project: User does not have bigquery.jobs.create permission in project my-project (Google Cloud / Firebase)BigQuery: Access Deni…Cloud Run 403: Your client does not have permission to get URL — Cloud Run: Error: Forbidden — Your client does not have permission to get URL / from this server (Google Cloud / Firebase)Cloud Run 403: Your c…CORS: No Access-Control-Allow-Origin (Cloud Storage) — Browser: Access to fetch at 'https://storage.googleapis.com/bucket/file' from origin 'https://app.example.com' has been blocked by CORS policy (Google Cloud / Firebase)CORS: No Access-Contr…FailedMount — Pod stuck ContainerCreating: MountVolume.SetUp failed / Unable to attach or mount volumes: timed out waiting for the condition (Kubernetes)FailedMountINSTALL_FAILED_INSUFFICIENT_STORAGE — INSTALL_FAILED_INSUFFICIENT_STORAGE: Failure [INSTALL_FAILED_INSUFFICIENT_STORAGE] (Android)INSTALL_FAILED_INSUFF…Key creation is not allowed on this service account — GCP: FAILED_PRECONDITION: Key creation is not allowed on this service account (constraints/iam.disableServiceAccountKeyCreation) (Google Cloud / Firebase)Key creation is not a…Multi-Attach error — Multi-Attach error for volume: Volume is already exclusively attached to one node and can't be attached to another (Kubernetes)Multi-Attach errorNoSuchBucket / 404 The specified bucket does not exist — Cloud Storage: 404 Not Found — The specified bucket does not exist / No such object: bucket/object (Google Cloud / Firebase)NoSuchBucket / 404 Th…403: does…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.