title: service account does not have storage.objects.get access for Google Cloud Storage
body: <p>I have created a service account in Google Cloud Console and selected role <code>Storage</code> / <code>Storage Admin</code> (i.e. full control of GCS resources).</p>
  
  <p><code>gcloud projects get-iam-policy my_project</code> seems to <a href="https://stackoverflow.com/questions/47006062">indicate</a> that the role was actually selected:</p>
  
  <pre><code>- members:
    - serviceAccount:my_sa@my_project.iam.gserviceaccount.com
    role: roles/storage.admin
  - members:
    - serviceAccount:my_sa@my_project.iam.gserviceaccount.com
    role: roles/storage.objectAdmin
  - members:
    - serviceAccount:my_sa@my_project.iam.gserviceaccount.com
    role: roles/storage.objectCreator
  </code></pre>
  
  <p>And <a href="https://cloud.google.com/storage/docs/access-control/iam-roles" rel="noreferrer">documentation</a> clearly indicates that role <code>roles/storage.admin</code> comprises permissions <code>storage.objects.*</code> (as well as <code>storage.buckets.*</code>).</p>
  
  <p>But when I try using that service account in conjunction with the Google Cloud Storage Client Library for Python, I receive this error message:</p>
  
  <blockquote>
    <p>my_sa@my_project.iam.gserviceaccount.com does not have
    storage.objects.get access to my_project/my_bucket.</p>
  </blockquote>
  
  <p>So why would the selected role not be sufficient in this context?</p>