title: Is there a way to set path level read/write permissions in GCP and Azure? (like AWS)
body: <p>For a project it is important for me to get access to a user's cloud directory, but only a particular path. If possible, I want this to be as specific as possible, configured to something like &quot;read access in this directory&quot;, and &quot;write access in this directory&quot;, and nothing else. (I don't want to ask for too much access to a user's storage account.)</p>
  <p>It is possible to grant path level permissions with a programmatic access key in AWS by creating this JSON file. (<a href="https://aws.amazon.com/blogs/security/writing-iam-policies-grant-access-to-user-specific-folders-in-an-amazon-s3-bucket/" rel="nofollow noreferrer">https://aws.amazon.com/blogs/security/writing-iam-policies-grant-access-to-user-specific-folders-in-an-amazon-s3-bucket/</a>)</p>
  <p>I need to do the same thing for GCP and Azure. I have been researching this for a while and I haven't found anything exactly similar to the above for AWS.</p>
  <p>For Azure I found the SAS token, which could be set to a particular blob/item. (When you click three squares to right of blob it says &quot;generate SAS&quot;)-- however this option doesn't seem to be possible for a folder. There is the more global option of the Storage Account, but this is too global. Doesn't seem possible (<a href="https://stackoverflow.com/questions/37270955/is-it-possible-to-generate-sas-shared-access-signature-with-write-permission-f?rq=1">Is it possible to generate SAS (Shared Access Signature) with write permission for given directory in azure blob storage</a> )</p>
  <p>For GCP, from this (<a href="https://stackoverflow.com/questions/49819707/granting-directory-level-permissions-for-google-cloud-storage-rest-apis#:%7E:text=As%20explained%20in%20the%20documentation,%22directory%22%20in%20Cloud%20Storage">https://stackoverflow.com/questions/49819707/granting-directory-level-permissions-for-google-cloud-storage-rest-apis#:~:text=As%20explained%20in%20the%20documentation,%22directory%22%20in%20Cloud%20Storage</a> ) it just seems like this is not possible. Right now I'm just making a Service Account with Storage Admin and json credentials, however this is too global as before. There seems to be this idea of fine-grained access (<a href="https://cloud.google.com/storage/docs/access-control#choose_between_uniform_and_fine-grained_access" rel="nofollow noreferrer">https://cloud.google.com/storage/docs/access-control#choose_between_uniform_and_fine-grained_access</a> ) however I'm not sure if this is what I need/ how this would work.</p>
  <p>Is this just a flaw of Azure/GCP that they cannot provide this like AWS can? /Does anyone know how to do this; any advice appreciated. So far it just doesn't seem possible but I'd really like to find a work-around.</p>