From c0dc0b34b692d52b794aa11cd6d12b83896f5870 Mon Sep 17 00:00:00 2001 From: Sushant Khanna Date: Thu, 2 Apr 2026 14:28:49 +0000 Subject: [PATCH] Update guide for ch acl commands to better reflect difference between gsutil and gcloud storage format --- GCLOUD-MIGRATION.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/GCLOUD-MIGRATION.md b/GCLOUD-MIGRATION.md index 132c372bb..bc06cfcbd 100644 --- a/GCLOUD-MIGRATION.md +++ b/GCLOUD-MIGRATION.md @@ -83,6 +83,11 @@ Replaced by `gcloud storage {buckets|objects} describe` and `gcloud storage {buc **`gsutil acl ch` -> `gcloud storage update`** +Please note, for Gsutil, we followed a format of ENTITY:ROLE. For Gcloud, this format changes to a key-value pair, similar to `entity=user-tim@gmail.com,role=OWNER` for the `-u` flag as an example. +We need to append a prefix for emails/ids entities depending on the flag. For `-u` it is `user-`, for `-g`, it is `group-` and for `-p` it is `project-`. + +Also, in Gsutil, we used to utilise abbreviations for roles themselves, like R for READ, W for Write, etc. For Gcloud, we want to use the full terms similar to JSON for GCS as can be found in [documentation](https://docs.cloud.google.com/storage/docs/access-control/lists#permissions). + | gsutil Flag | gcloud storage Flag | Applies To | Notes | | --- | --- | --- | --- | | -u | --add-acl-grant=GRANT | Buckets/Objects | Adds grant for a user. Format: ENTITY:ROLE | @@ -115,6 +120,11 @@ Replaced by `gcloud storage buckets describe` and `gcloud storage buckets update **`gsutil defacl ch` -> `gcloud storage buckets update`** +Please note, for Gsutil, we followed a format of ENTITY:ROLE. For Gcloud, this format changes to a key-value pair, similar to `entity=user-tim@gmail.com,role=OWNER` for the `-u` flag as an example. +We need to append a prefix for emails/ids entities depending on the flag. For `-u` it is `user-`, for `-g`, it is `group-` and for `-p` it is `project-`. + +Also, in Gsutil, we used to utilise abbreviations for roles themselves, like R for READ, W for Write, etc. For Gcloud, we want to use the full terms similar to JSON for GCS as can be found in [documentation](https://docs.cloud.google.com/storage/docs/access-control/lists#permissions). + | gsutil Flag | gcloud storage Flag | Notes | | --- | --- | --- | | -u | --add-default-object-acl-grant=GRANT | Adds grant for a user. Format: ENTITY:ROLE. |