Google Cloud StorageのバケットIPフィルタリングを試してみる

$ gcloud iam roles create customStorageRole \
    --project=｛プロジェクトID｝ \
    --title="Custom Storage Role" \
    --description="Role for creating buckets with IP filters" \
    --permissions=storage.buckets.create,storage.buckets.setIpFilter

$ gcloud projects add-iam-policy-binding ｛プロジェクトID｝ \
    --member="user:{メールアドレス}" \
    --role="projects/｛プロジェクトID｝/roles/customStorageRole" \
    --condition=None

{
  "mode": "Enabled",
  "publicNetworkSource":
    {
    "allowedIpCidrRanges":
      ["192.0.1.0/24","192.0.2.0/24"]
    }
}

$ gcloud alpha storage buckets create gs://BUCKET_NAME --location=us-east1 --ip-filter-file=ip-filter.json

$ gcloud storage ls gs://cm-kobayshi-ip-filter
ERROR: (gcloud.storage.ls) [{メールアドレス}] does not have permission to access b instance [cm-kobayshi-ip-filter] (or it may not exist): There is an IP filtering condition that is preventing access to the resource. This command is authenticated as {メールアドレス} which is the active account specified by the [core/account] property.

$ gcloud storage ls gs://cm-kobayshi-ip-filter
gs://cm-kobayshi-ip-filter/sample.csv

$ gcloud alpha storage buckets update gs://cm-kobayshi-ip-filter --ip-filter-file=ip-filter.json # 更新
$ gcloud alpha storage buckets update gs://cm-kobayshi-ip-filter --clear-ip-filter # 削除
$ gcloud alpha storage buckets describe gs://cm-kobayshi-ip-filter --format="default(ip_filter_config)" # 確認
ERROR: (gcloud.alpha.storage.buckets.describe) [{メールアドレス}] does not have permission to access b instance [cm-kobayshi-ip-filter] (or it may not exist): There is an IP filtering condition that is preventing access to the resource. This command is authenticated as {メールアドレス} which is the active account specified by the [core/account] property.

$ gcloud storage rm --recursive gs://cm-kobayshi-ip-filter
Removing objects:
  Completed 0                                                                  
ERROR: (gcloud.storage.rm) [{メールアドレス}] does not have permission to access b instance [cm-kobayshi-ip-filter] (or it may not exist): There is an IP filtering condition that is preventing access to the resource. This command is authenticated as {メールアドレス} which is the active account specified by the [core/account] property.