Cloud Storage uses a
service agent
to move data to a Cloud Storage bucket. This service agent
is created the first time that you call
googleServiceAccounts.get.
The destination bucket does not need to belong to the same project as the service agent. The steps are the same regardless of which project the bucket is in.
User permissions
In order to grant the required permissions to the service agent, you must have the relevant permissions on the destination bucket:
storage.buckets.getIamPolicystorage.buckets.setIamPolicy
The Storage Legacy Bucket Owner role (roles/storage.legacyBucketOwner) or
the Storage Admin role (roles/storage.admin) provide the required
permissions.
Auto-granting permissions in the Google Cloud console
If you're using the Google Cloud console to create your transfer and have the permissions listed in User permissions, the service agent will automatically be granted the required permissions on your destination bucket.
You can skip the steps on this page. If required,