Cloud Storage 403 Diagnostic
Diagnose Google Cloud Storage 403 Permission Denied errors and access conflicts step by step
- Repository
- google/skills
- Stars
- 21,782
- Licence
- Apache-2.0
- Files
- 2 files
What it does
Once installed, the agent works through access-denied problems on Google Cloud Storage (buckets and files) in a structured way. It identifies who is trying to access what, checks the likely causes such as IAM permissions, ACLs, perimeter rules and credential mismatches, and explains the findings. Before changing anything, it must show you the exact command and wait for your explicit approval for each one.
Great for
- Engineers who hit a 403 Permission Denied error on a Cloud Storage bucket or object
- Cloud admins troubleshooting IAM, uniform bucket-level access or VPC Service Controls conflicts
- Teams who want a read-only analysis of why a service account cannot access data
Skip it if
- Creating buckets, routine uploads or downloads, or Cloud Storage FUSE mounts, which the skill says it should not be used for (it is only for diagnosing access problems)
- Proactive security audits of a project, since the skill is scoped to troubleshooting denials rather than scanning for risks
- Non-technical users without Google Cloud access, because the diagnosis depends on running gcloud inspection commands against your project
Try asking
- “Why am I getting 403 Permission Denied when my service account tries to read gs://my-bucket/data.csv?”
- “Analyze this 403 error from a signed URL and tell me whether it is a SignatureDoesNotMatch problem”
- “Check whether VPC Service Controls or bucket IP filtering is blocking my Compute Engine VM from reaching the bucket”
- “Help me work out which least-privilege role my diagnostic account needs to inspect the bucket IAM policy”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 2 original files, the Apache-2.0 licence and an attribution note.
google-cloud-storage-diagnostic.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip google-cloud-storage-diagnostic.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip google-cloud-storage-diagnostic.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Give the exact principal (user or serviceAccount email), the bucket or object path, and the operation that failed, so the agent can focus its checks.
- Review each proposed gcloud command before approving it; the skill requires a separate yes or no for every state-changing command.
- Start with read-only inspection; if get-iam-policy itself returns 403, the skill will check perimeters first rather than retrying in a loop.
What's inside
- references/403_troubleshooting.md
- SKILL.md
Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-11-02. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.