Associate Cloud EngineerDemo

Google Cloud provides predefined IAM roles for Cloud Storage that follow the principle of least privilege. The Storage Admin role (roles/storage.admin) grants full control over both buckets and objects, including creating, listing, and deleting buckets, as well as managing objects within them—matching the requirement to manage buckets and files. Project Editor is far broader than needed, granting edit access across nearly all GCP services, which violates least-privilege best practices. Storage Object Admin and Storage Object Creator only provide control over objects (files) and do not grant permissions to manage buckets themselves, so they do not satisfy the full requirement.