关于使用Node.js + @google-cloud访问跨项目全局存储桶及迁移无关联项目的Play Console存储桶的技术咨询

Hey there, let's break down your problem step by step—this is a common gotcha with Play Console's managed storage buckets, so I've got you covered.

First, let's clarify why you're seeing this discrepancy: that Play Console download reports bucket is a Google-managed global bucket tied directly to your Play Console account, not your GCP project. That's why gcloud (which uses your user credentials linked to Play Console) can see it, but @google-cloud/storage (which relies on project-bound service account permissions) can't access it out of the box.

Option 1: Access the original bucket directly (no migration needed) #

This is the simplest solution—you don't need to move the bucket; you just need to grant your GCP service account permission to access it:

• Head to your Google Play Console, navigate to your app's Download reports section, and click the storage bucket link to open it in the Cloud Storage console.
• Go to the Permissions tab of the bucket.
• Click Add members, then enter the email of the service account you're using with @google-cloud/storage.
• Assign a role like Storage Object Viewer (if you only need to read reports) or Storage Admin (if you need to modify files).
• Save the changes, then update your Node.js code to use this authorized service account:

  const { Storage } = require('@google-cloud/storage');
  // Initialize with your service account key
  const storage = new Storage({
    keyFilename: './path/to/your-service-account-key.json'
  });
  // Access the Play Console bucket directly
  const playBucket = storage.bucket('your-play-console-bucket-uri');
  // Test listing files
  async function fetchReports() {
    try {
      const [files] = await playBucket.getFiles();
      console.log('Available download reports:');
      files.forEach(file => console.log(file.name));
    } catch (err) {
      console.error('Error accessing bucket:', err);
    }
  }
  fetchReports();
  

After setting this up, your @google-cloud/storage client should be able to access the bucket just like gcloud does.

Option 2: Sync bucket content to your GCP project (if you must have it in your project) #

Unfortunately, you can't directly "move" the Play Console-managed bucket to your GCP project—it's owned and managed by Google's Play infrastructure. However, you can sync its contents to a bucket in your project:

• One-time sync with gcloud:

  gcloud storage cp gs://your-play-console-bucket/** gs://your-project-bucket/ --recursive
  

• Automated sync for new reports: If you need to capture new reports as they're added, set up a Cloud Function triggered by the Play Console bucket's finalize event (when a new file is uploaded). The function can copy the new file to your project's bucket automatically.

Why gcloud works but the library doesn't #

Quick recap: gcloud uses your personal user credentials, which are linked to your Play Console account—so you have implicit access to the bucket. The @google-cloud/storage library uses service accounts, which are tied to GCP projects and need explicit IAM permissions to access external buckets.

Hope this solves your problem! Let me know if you hit any snags setting up the permissions or sync.

备注：内容来源于stack exchange，提问作者Chris