google_storage_bucket_iam_member cost estimation

A google_storage_bucket_iam_member grants a single role to a single principal on one Cloud Storage bucket, added to the bucket's IAM policy without overwriting it. The binding is free. There is no charge for granting bucket access, for the number of bindings, or for evaluating them on each request.

The binding's cost relevance is the bucket it points at. Cloud Storage bills for stored data per GB-month by storage class, for operations (Class A writes and Class B reads) per 10,000, and for egress per GB. A binding that grants roles/storage.objectViewer lets a principal read objects, generating Class B operations and egress; a binding that grants write access lets a principal add data that bills for storage. So the binding enables the cost, it does not create it.

As with project bindings, google_storage_bucket_iam_member is additive and safe, whereas google_storage_bucket_iam_policy is authoritative. Neither is billed. c3x treats bucket IAM bindings as free and prices the bucket's storage, operations, and egress that the granted access is used to drive.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "google_storage_bucket_iam_member" "reader" {
  bucket = google_storage_bucket.assets.name
  role   = "roles/storage.objectViewer"
  member = "serviceAccount:${google_service_account.app.email}"
}

Pricing dimensions

What you actually pay for when you provision google_storage_bucket_iam_member.

Dimension	Unit	What's being charged
Bucket IAM binding	free	The role binding on the bucket, and any number of bindings, have no charge. $0
Bucket storage	per GB-month	Data stored in the bucket the access points at, priced by storage class. $0.020/GB-month for Standard in us-central1
Operations and egress	per 10k ops + per GB	Reads and writes the granted access enables, plus egress when objects leave the region or network. Class B: ~$0.004 per 10k reads

Optimization tips

Common ways to reduce google_storage_bucket_iam_member cost without changing the workload.

Grant read-only where possible

The binding is free, but write access lets a principal add data that bills for storage indefinitely. Read-only roles limit which principals can grow the bucket's stored-data cost.

Scope access to specific buckets

Bucket-level bindings are finer-grained than project-level storage roles, so access, and the ability to drive a bucket's cost, is limited to exactly the buckets that need it.

Prefer additive bindings

google_storage_bucket_iam_member adds one binding safely. google_storage_bucket_iam_policy replaces the whole bucket policy. Neither costs anything; the additive form avoids accidental lockouts.

FAQ

Does a bucket IAM binding cost money?

No. IAM bindings on a Cloud Storage bucket are free. Cost comes from the bucket itself: stored data per GB-month, operations per 10,000, and egress per GB, which the access enables.

How does granting bucket access affect my bill?

By enabling operations and egress. Read access generates Class B operations and egress; write access lets a principal add data that bills for storage. The binding is free.

How do I estimate the cost behind a bucket binding?

Price the bucket's stored data, operations, and egress. c3x prices the google_storage_bucket and treats the IAM binding as the free access grant it is.