Google storage write only (no delete)

Question

I would like to use google storage for backing up my database. However, for security reason, i would like to use a "service account" with a write only role.

But it seems like this role can also delete objects! So my question here: can we make a bucket truly "write only, no deletion"? And of course how?

Answer 1

This is now possible with the Google Cloud Storage Object Creator role roles/storage.objectCreator.

https://cloud.google.com/iam/docs/understanding-roles#storage.objectCreator

Answer 2

You cannot do this, unfortunately. There is currently no way to grant permission to insert new objects while denying the permission to delete or overwrite existing objects.

You could perhaps implement this using two systems, the first being the backup service which wrote to a temporary bucket, and the second being an administrative service that exclusively had write permission into the final backup bucket and whose sole job was to copy in objects if and only if there are no existing objects at that location. Basically you would trust this second job as an administrator.