Google Cloud Storage permissions

Your Simple FTP Service accesses your Google Cloud Storage bucket as a service account whose JSON key you upload when creating the service. If that account is missing a role, some operations work while others fail with confusing errors - the failures below are all permission problems.

The permissions that make GCS work

• The service account needs the Storage Admin role - grant it on the bucket (or at project level in IAM & Admin)
• The service account needs the Storage Legacy Bucket Owner role on the bucket

The GCS getting-started guide walks through granting both while creating the service account and bucket.

Error: "subsystem request failed on channel 0"

If SFTP connections to your service fail with:

subsystem request failed on channel 0

the service account cannot read the bucket's metadata. In our logs this appears as:

failed to connect and get bucket information: googleapi:
Error 403: <account>@<project>.iam.gserviceaccount.com does
not have storage.buckets.get access to <bucket>., forbidden

Fix: grant the service account the Storage Legacy Bucket Owner role on the bucket.

Error: "failed to get object attributes in backend"

If uploads work but downloads fail with an error mentioning failed to get object attributes in backend, the account can write objects but cannot read their metadata back.

Fix: grant the Storage Admin role - first on the bucket, and if downloads still fail, also on the account under IAM & Admin.

Still stuck?

Verify access from the service's Configuration tab in the console (the Verify Access check exercises exactly these permissions), or contact support.