> For the complete documentation index, see [llms.txt](https://helpcenter.gitprotect.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpcenter.gitprotect.io/storage/cloud-storage/google-cloud-storage/required-permissions.md).

# Required permissions

Identity and Access Management (IAM) roles and permissions for Cloud Storage.

**Google Cloud Storage requires specific permissions to allow GitProtect to access and manage backup data. Configuring these permissions ensures seamless backup and recovery operations while maintaining strict access controls on the target storage bucket.**

***

## Roles and permissions <a href="#iam_roles_and_permission" id="iam_roles_and_permission"></a>

To use a **Google Cloud Storage** bucket as backup storage repository in **GitProtect**, it is recommended to assign the Storage Admin IAM role (`roles/storage.admin` with full control of buckets and objects) to the user account on the designated bucket.

Alternatively, you can create a service account with the following permissions:

1. `storage.objects.list`
2. `storage.objects.get`
3. `storage.objects.create`
4. `storage.objects.delete`

***

## Support for immutable storage <a href="#support_for_immutable_storage" id="support_for_immutable_storage"></a>

**GitProtect** does not support **Google Cloud Storage** buckets with Object Lock or retention enabled. If your compliance strategy requires immutability, select a storage target where this feature is fully supported, such as **Xopero Cloud Storage**, **AWS**, **Wasabi**, or **Backblaze B2**.

***

## Useful links and items

{% embed url="<https://cloud.google.com/storage/docs/access-control/iam-roles>" %}

{% embed url="<https://cloud.google.com/storage/docs/access-control/using-iam-permissions#json>" %}

{% embed url="<https://cloud.google.com/blog/products/storage-data-transfer/protecting-cloud-storage-with-worm-key-management-and-more-updates>" %}