googleapis/mcp-toolbox · error

failed to get IAM policy for bucket %q: %w

Error message

failed to get IAM policy for bucket %q: %w

What it means

Error "failed to get IAM policy for bucket %q: %w" thrown in googleapis/mcp-toolbox.

Source

Thrown at internal/sources/cloudstorage/cloudstorage.go:362

	if err := s.validateBucket(bucket); err != nil {
		return nil, err
	}
	attrs, err := s.client.Bucket(bucket).Attrs(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to get metadata for bucket %q: %w", bucket, err)
	}
	return attrs, nil
}

// GetBucketIAMPolicy returns bucket IAM bindings in a stable, agent-friendly
// shape while preserving conditional bindings when present.
func (s *Source) GetBucketIAMPolicy(ctx context.Context, bucket string) (map[string]any, error) {
	if err := s.validateBucket(bucket); err != nil {
		return nil, err
	}
	policy, err := s.client.Bucket(bucket).IAM().Policy(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to get IAM policy for bucket %q: %w", bucket, err)
	}

	bindings := make([]map[string]any, 0)
	if policy != nil && policy.InternalProto != nil {
		for _, binding := range policy.InternalProto.Bindings {
			members := append([]string(nil), binding.Members...)
			sort.Strings(members)

			out := map[string]any{
				"role":    binding.Role,
				"members": members,
			}
			if binding.Condition != nil {
				out["condition"] = map[string]any{
					"title":       binding.Condition.Title,
					"description": binding.Condition.Description,
					"expression":  binding.Condition.Expression,
				}

View on GitHub (pinned to 8cc6e09de2)

When it happens

Trigger: Thrown at internal/sources/cloudstorage/cloudstorage.go:362 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/4ca2c0abbe99b52a. Report an issue: GitHub.