# Cloud Storage: 403 Forbidden — user@example.com does not have storage.objects.get access to the Google Cloud Storage object

**Code:** `403: does not have storage.objects.get access` · **Category:** Google Cloud / Firebase · **Seen on:** Google Cloud

The identity making the request has no read permission on that bucket or object.

## Meaning

Grant `roles/storage.objectViewer` (read) or `objectAdmin` on the bucket to the right principal. With uniform bucket-level access, object ACLs no longer work. Public access also needs `allUsers` plus public-access-prevention disabled. Note signed-in browser accounts may differ from the service account your app uses.

## Common causes

- Missing objectViewer/objectUser role
- Uniform bucket-level access ignoring ACLs
- Public access prevention enforced
- Wrong service account in the app
- Requester pays or different project

## Quick fix

1. `gsutil iam ch serviceAccount:SA:objectViewer gs://BUCKET`
2. Check the active identity
3. For public files, allow `allUsers` objectViewer (if policy permits)

## Detailed fix by platform

### gcloud

1. `gcloud storage buckets add-iam-policy-binding gs://BUCKET --member=serviceAccount:SA@PROJECT.iam.gserviceaccount.com --role=roles/storage.objectViewer`

## How to diagnose

1. **Identity** — Which principal?
2. **Role** — objectViewer?
3. **Policy** — Public access prevention?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/gcp/gcs-403-storage-objects-get-denied)