Group read access to google bucket not functioning
I am the owner of a bucket, getzlab-workflows-reference_files-getzlab_ca. I have granted the group Getz_Lab@firecloud.org Storage Object Viewer privileges for that bucket, but several members of that group have been unable to access objects in that bucket through Terra. What is the correct way to assign group privileges to a bucket holding files that will be accessed by a terra workflow?
Thanks.
Comments
2 comments
Hi Chet,
If users are interested in using files from an external bucket, they will need to have their Terra Proxy Group, located in their Terra profiles, added to the external bucket with Storage Object Viewer permissions. If they wanted to write to the external bucket, the Proxy Group will also need Storage Object Creator permissions.
This gives Terra the permissions it needs to read (and write) files on behalf of the user running the workflow.
I hope this helps! If you still run into any trouble, please let us know.
Kind regards,
Jason
Hi Chet,
Additional information important to know. Adding users to a Terra group should automatically also add their Proxy Groups. Since the group you shared the external bucket with looks like a Terra group, these users should be seeing that they have access to that data.
Can you confirm that these users are indeed members of the Getz_Lab@firecloud.org Terra group? If so, would you be able to share the addresses of the users having issues? Are they having issues with the files in a workspace or when running a workflow? If you or they can share their workspace with GROUP_FireCloud-Support@firecloud.org and provide a link for the workspace, and point to the submission ID where the error occurred (if one exists) I'll be happy to take a look.
I'm also happy to migrate this issue to a private ticket if preferred.
Kind regards,
Jason
Please sign in to leave a comment.