# Google Cloud: 403 PERMISSION_DENIED — Permission 'storage.objects.get' denied on resource (or it may not exist)

**Code:** `PERMISSION_DENIED: Permission 'x' denied on resource` · **Category:** Google Cloud / Firebase · **Seen on:** Google Cloud

The caller's identity lacks the IAM permission named in the message on that resource.

## Meaning

The message names the missing permission. Find a role that includes it, grant it at the narrowest scope to the right principal (user, service account), and wait a few minutes for propagation. 'Or it may not exist' also covers typos in project/resource names and wrong project selection.

## Common causes

- Role containing the permission not granted
- Wrong account/service account in use (check `gcloud auth list`)
- Wrong project or resource name
- Org policy or VPC-SC blocking
- IAM change not yet propagated

## Quick fix

1. `gcloud projects add-iam-policy-binding PROJECT --member=... --role=ROLE`
2. Use the IAM Policy Troubleshooter to see why access is denied
3. Confirm the active identity: `gcloud auth list`

## Detailed fix by platform

### gcloud

1. `gcloud projects get-iam-policy PROJECT --flatten="bindings[].members" --filter="bindings.members:USER_OR_SA" --format="table(bindings.role)"`

## How to diagnose

1. **Permission** — Named in message?
2. **Identity** — Which principal calls?
3. **Scope** — Project/resource correct?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/gcp/permission-denied-iam-403)