对于每个项目，您都可以使用 Identity and Access Management (IAM) 授予管理和处理项目的权限。如果您向某主账号（例如用户账号）授予 IAM 角色，则该主账号可获得特定权限，从而能够执行操作。如果您在项目级层授予角色，该角色提供的访问权限适用于项目中的每个存储桶和对象。或者，如果您为单个存储桶授予角色，该角色提供的访问权限将仅适用于该存储桶以及该存储桶包含的对象。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Projects\n\nThis page describes the relationship between Google Cloud console projects and\nCloud Storage resources. To learn more about Google Cloud console projects\nin general, read about [Projects](/docs/overview#projects) in Google Cloud.\n\nWhat is a project?\n------------------\n\nA project organizes all your Google Cloud resources. All data in\nCloud Storage belongs inside a project. A project consists of a set of\nusers; a set of APIs; and billing, authentication, and monitoring settings for\nthose APIs. So, for example, all of your Cloud Storage buckets and objects,\nalong with user permissions for accessing them, reside in a project. You can\nhave one project, or you can create multiple projects and use them to organize\nyour Google Cloud resources, including your Cloud Storage data, into logical\ngroups.\n\nWhen to specify a project\n-------------------------\n\nMost of the time, you do not need to specify a project when performing actions\nin Cloud Storage; however you should include either the project ID or\nthe project number in the following cases: \n\n### Console\n\n- When using Cloud Storage with the Google Cloud console, you're\n automatically associated with a project. You can change projects by using\n the drop-down menu at the top of the Google Cloud console window.\n\n- When first accessing a bucket that has enabled [Requester Pays](/storage/docs/requester-pays),\n you're prompted to select a project to bill requests to. You can\n subsequently change the billing project by using the **Change project**\n button located above the list of objects in the bucket.\n\n### Command line\n\nThe following commands use the [`project` property](/sdk/gcloud/reference/config/set) set in your\nGoogle Cloud CLI configuration, unless you use the\n[global `--project` flag](/sdk/gcloud/reference#--project) in the command to specify a different project:\n\n- [`storage buckets create`](/sdk/gcloud/reference/storage/buckets/create)\n- [`storage ls`](/sdk/gcloud/reference/storage/ls) (when listing buckets) and [`storage buckets list`](/sdk/gcloud/reference/storage/buckets/list)\n- [`storage service-agent`](/sdk/gcloud/reference/storage/service-agent)\n- [`storage hmac create`](/sdk/gcloud/reference/storage/hmac/create) and [`storage hmac list`](/sdk/gcloud/reference/storage/hmac/list)\n\nUse the [global `--billing-project` flag](/sdk/gcloud/reference#--billing-project), along with a project\nidentifier, to indicate the project to charge for bucket access. This is\nrequired when accessing a bucket that has enabled [Requester Pays](/storage/docs/requester-pays)\nand is optional otherwise.\n\n### Client libraries\n\nThe [Cloud Storage Client Libraries](/storage/docs/reference/libraries) require a project to\nbe specified under the same circumstances as the JSON API.\n\n### JSON API\n\nThe following methods require you to specify a project:\n\n- [List buckets](/storage/docs/json_api/v1/buckets/list)\n- [Insert bucket](/storage/docs/json_api/v1/buckets/insert)\n- [Get project service agent](/storage/docs/json_api/v1/projects/serviceAccount/get)\n- All methods associated with the [HMAC key resource](/storage/docs/json_api/v1/projects/hmacKeys)\n\nThe project is sent as a parameter in the request URL, as in the following\nexample: \n\n```\nGET https://storage.googleapis.com/storage/v1/b?project=PROJECT_IDENTIFIER\n```\n\n- To indicate a project to charge for bucket access, use the 'userProject'\n query paratemer, along with a project identifier, as in the following\n example:\n\n ```\n GET https://storage.googleapis.com/storage/v1/b?userProject=PROJECT_IDENTIFIER\n ```\n\n This query parameter is required when accessing a\n bucket that has enabled [Requester Pays](/storage/docs/requester-pays) and is optional otherwise.\n\n### XML API\n\nThe following requests require you to specify a project, unless you have\n[set a default project](/storage/docs/aws-simple-migration#defaultproj) for interoperable access:\n\n- [List buckets](/storage/docs/xml-api/get-service)\n- [Create a bucket](/storage/docs/xml-api/put-bucket-create)\n\nThe project associated with these XML API requests is specified in the\n[`x-goog-project-id`](/storage/docs/xml-api/reference-headers#xgoogprojectid) HTTP header, as in the following example: \n\n```\nx-goog-project-id: PROJECT_ID\n```\n\nThe header is optional for other XML API requests.\n\n- To indicate a project to charge for bucket access, use the\n 'x-goog-user-project' header, along with a project ID, as in the following\n example:\n\n ```\n x-goog-user-project: PROJECT_ID\n ```\n\n This header is required when accessing a bucket that has enabled\n [Requester Pays](/storage/docs/requester-pays) and is optional otherwise.\n\nProjects and permissions\n------------------------\n\nFor each project, you use [Identity and Access Management (IAM)](/storage/docs/access-control/iam) to grant the ability\nto manage and work on your project. When you grant an IAM *role*\nto a *principal* , such as a user account, that principal obtains certain\n*permissions* that allow them to perform actions. When you grant a role at the\nproject level, the access provided by the role applies to every bucket and\nobject within the project. Alternatively, when you grant a role for an\nindividual bucket, the access provided by the role is limited to just that\nbucket and the objects the bucket contains.\n\nFor a list of available roles that apply to Cloud Storage, as well as\na discussion about how a special set of roles, called *basic roles* , apply to\nCloud Storage, see\n[Cloud Storage IAM roles](/storage/docs/access-control/iam-roles).\n\nFor instructions for viewing, granting, and revoking a principal's roles at the\nbucket and project level, see [Using IAM with projects](/storage/docs/access-control/using-iam-permissions).\n\nService accounts\n----------------\n\n[Service accounts](/iam/docs/service-accounts) allow applications to authenticate and access\nGoogle Cloud resources and services. For example, you can create a service\naccount that your Compute Engine instances use to access objects stored\nin Cloud Storage buckets. Service accounts are created within a project\nand have a unique email address that identifies them.\n\nThe following are examples of actions related to Cloud Storage that are\noften taken by service accounts that [you create and manage](/iam/docs/creating-managing-service-accounts):\n\n- Performing [Storage Transfer Service](/storage-transfer/docs/overview) transfers.\n- [Moving data to/from Cloud SQL instances](/sql/docs/mysql/import-export).\n- Creating [signed URLs](/storage/docs/access-control/signed-urls).\n\n### Service agents\n\nA [service agent](/iam/docs/service-agents) is a special type of service account that acts on\nbehalf of a Google Cloud service. Cloud Storage uses a service\nagent for the following features:\n\n- [Pub/Sub Notifications for Cloud Storage](/storage/docs/pubsub-notifications).\n- [Customer-Managed Encryption Keys](/storage/docs/encryption/customer-managed-keys).\n\nThe Cloud Storage service agent is not initially available when you\nmake a project. Instead, it is automatically activated the first time it's\naccessed, either by one of the features listed above or when you\n[request the service agent's name](/storage/docs/getting-service-agent). The service agent must be activated\nprior to [assigning permissions](/storage/docs/access-control/using-iam-permissions) to it.\n\nThe following is an example email address for the Cloud Storage service\nagent associated with [project number](/resource-manager/docs/creating-managing-projects#identifying_projects) `123456789876`: \n\n```\nservice-123456789876@gs-project-accounts.iam.gserviceaccount.com\n```\n\nWhat's next\n-----------\n\n- Complete one of the [Cloud Storage quickstarts](/storage/docs/introduction#quickstarts).\n- Learn how to [create a new project and manage existing projects](/resource-manager/docs/creating-managing-projects).\n- Find out how to [use the Google Cloud console to manage your data](/storage/docs/cloud-console).\n- [Manage your project's service accounts](https://console.cloud.google.com/iam-admin/serviceaccounts)."]]
