How to exclude storage.bucket.list permission on public gcp storage bucket
I am not entirely sure what configs you were using, but here is a process using CLI (gcloud and gsutil). The end product is a new custom role replacing the current standard roles/storage.objectViewer on allUsers for a GCP Bucket.
Recommend using GCP Cloud Cloud Shell in your Project: https://cloud.google.com/shell

Create a new Role with the Custom Permissions you would like.

Create yaml file to hold the new config:
vi custom_role.yaml

Add role configurations to new custom_role.yaml:
title: &quot;storageobjectviewer.nolist&quot;
description: &quot;Storage Object Viewer Role without source objects list&quot;
stage: &quot;ALPHA&quot;
includedPermissions:
- resourcemanager.projects.get
- storage.objects.get

Create new Role in GCP:
gcloud iam roles create storageobjectviewer.nolist --project=[YOUR PROJECT] --file=custom_role.yaml


Pull current permissions for [YOUR BUCKET] locally:


gsutil iam get gs://[YOUR BUCKET] &gt; perms.txt


Update Permissions with the new role.

Should only be this section:

{
  &quot;members&quot;: [
    &quot;allUsers&quot;
  ],
  &quot;role&quot;: &quot;projects/[YOUR PROJECT]/roles/storageobjectviewer.nolist&quot;
}



Update the allUsers to the new role on [YOUR BUCKET]


gsutil iam set perms.txt  gs://[YOUR BUCKET]

The new configuration should be viewable in CLI:
gsutil iam get gs://[YOUR BUCKET]

Also in the UI:
Bucket Details -&gt; Permissions

and IAM -&gt; Roles

Hopefully this helps!
Additional Info:

https://cloud.google.com/iam/docs/creating-custom-roles#iam-custom-roles-create-gcloud
https://cloud.google.com/storage/docs/gsutil/commands/iam
https://cloud.google.com/storage/docs/access-control/making-data-public#gsutil
https://cloud.google.com/storage/docs/access-control/iam-roles