Google CloudCloud StorageSecurity

`google_storage_bucket_iam_binding` cost estimation

Grants a role to members on a single Cloud Storage bucket, authoritatively for that role. IAM is free. Cost lives in the bucket's storage, operations, and egress, and a public grant can drive a large egress bill.

The google_storage_bucket_iam_binding resource grants an IAM role, such as roles/storage.objectViewer, to a set of members on one bucket. Like all Google Cloud IAM, the binding is free. There is no charge for the grant, the policy, or the access evaluation. The cost is entirely in the bucket the access points at and, critically, in how much data flows because of who you granted access to.

The parent google_storage_bucket bills three things. Storage is by class and volume: Standard is about $0.020/GB-month, Nearline about $0.010, Coldline about $0.004, and Archive about $0.0012. Operations bill per request: Class A operations (writes, lists) at about $0.05 per 10,000 and Class B operations (reads) at about $0.004 per 10,000. Network egress to the internet is about $0.12/GB for the first tier, and egress is where an IAM binding can turn into a real number.

The cost-adjacent gotcha unique to bucket IAM is the public grant. Granting roles/storage.objectViewer to allUsers or allAuthenticatedUsers makes objects readable by the internet. If that bucket holds anything sizeable and it gets linked, scraped, or hotlinked, every download is billed egress at about $0.12/GB plus Class B operations. A single popular or leaked object in a public bucket can generate a surprising egress bill, and it is the IAM binding that opened the door. Serving public content through Cloud CDN or a signed-URL pattern is both cheaper at scale and safer than a blanket public bucket.

The behavioral gotcha is that google_storage_bucket_iam_binding is authoritative for its role: it replaces the entire member list for that role on the bucket every apply, so it can silently remove grants made elsewhere. For additive grants use google_storage_bucket_iam_member instead. Getting this wrong can either expose data (egress and security cost) or remove needed access (operational cost).

c3x flags google_storage_bucket_iam_binding as free and attributes storage, operations, and egress cost to the bucket, while treating a public grant as a cost-and-exposure signal.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "google_storage_bucket" "assets" {
  name          = "app-public-assets"
  location      = "US"
  storage_class = "STANDARD"

  uniform_bucket_level_access = true
}

resource "google_storage_bucket_iam_binding" "viewers" {
  bucket = google_storage_bucket.assets.name
  role   = "roles/storage.objectViewer"

  members = [
    "group:content-team@example.com",
    "serviceAccount:cdn-origin@my-project-id.iam.gserviceaccount.com",
  ]
}

Pricing dimensions

What you actually pay for when you provision google_storage_bucket_iam_binding.

Dimension	Unit	What's being charged
IAM binding	free	The bucket role grant, its policy, and access evaluation carry no charge. $0 (free)
Storage (Standard)	per GB-month	Object storage in the bucket. Nearline, Coldline, and Archive classes cost progressively less. about $0.020/GB-month (Standard)
Class A operations	per 10,000	Writes, lists, and other mutating requests against the bucket. about $0.05 per 10,000
Class B operations	per 10,000	Reads and object gets, which a public grant can multiply dramatically. about $0.004 per 10,000
Internet egress	per GB	Data downloaded from the bucket to the internet. A public grant makes this the main cost risk. about $0.12/GB (first tier)

Optimization tips

Common ways to reduce google_storage_bucket_iam_binding cost without changing the workload.

Never grant allUsers on a bucket with real data volume

Prevents runaway egress bills

A public objectViewer grant to allUsers exposes objects to the internet, and every download bills egress at about $0.12/GB plus read operations. A leaked or hotlinked object can run up a large bill. Keep buckets private and serve public content another way.

Serve public content through Cloud CDN

Large egress reduction on popular content

For content that must be public, front the bucket with Cloud CDN so cache hits are served at lower cost and origin egress drops. This is cheaper at scale than direct public downloads and keeps the bucket private.

Use google_storage_bucket_iam_member for additive grants

The binding is authoritative and overwrites the whole member list for its role on every apply, which can silently remove access. Prefer the member resource when you want to add a principal without disturbing existing grants.

Match storage class to access pattern

Up to 95% versus Standard on cold data

Access, not the IAM binding, is what makes data useful, so store it in the right class. Rarely read data belongs in Coldline or Archive at a fraction of Standard, while frequently served data stays Standard.

FAQ

Does a bucket IAM binding cost anything?

No. The binding and Cloud IAM in general are free. You pay for the bucket it points at: storage by class, per-request operations, and internet egress. The binding only decides who can trigger those charges.

How can an IAM binding cause a big bill?

By granting public access. Giving roles/storage.objectViewer to allUsers makes objects internet-readable, and every download is billed egress at about $0.12/GB plus read operations. A popular or leaked object in a public bucket can generate substantial egress.

What is the difference between iam_binding and iam_member on a bucket?

google_storage_bucket_iam_binding is authoritative: it sets the full member list for a role and overwrites other grants of that role on each apply. google_storage_bucket_iam_member adds one member without touching the rest. Use member for non-destructive changes.

What is the cheapest way to serve public files from a bucket?

Keep the bucket private and put Cloud CDN in front of it, or use signed URLs for controlled access. Both reduce origin egress and avoid the open-ended cost and exposure of a blanket public IAM grant.