Google Cloud Storage

gsutil iam ch serviceAccount:<aampe_service_account>:roles/storage.objectViewer gs://<your_bucket_name>

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": [
        "serviceAccount:<aampe_service_account_email>"
      ]
    },
    {
      "role": "roles/storage.legacyBucketReader",
      "members": [
        "serviceAccount:<aampe_service_account_email>"
      ]
    }
  ]
}

# Create a Workload Identity Pool
gcloud iam workload-identity-pools create aampe-pool \
    --location="global" \
    --display-name="Aampe Integration Pool"

# Create a Workload Identity Provider
gcloud iam workload-identity-pools providers create-oidc aampe-provider \
    --location="global" \
    --workload-identity-pool="aampe-pool" \
    --issuer-uri="https://accounts.google.com" \
    --allowed-audiences="<audience_provided_by_aampe>" \
    --attribute-mapping="google.subject=assertion.sub"

# Grant access to the bucket
gcloud storage buckets add-iam-policy-binding gs://<your_bucket_name> \
    --member="principal://iam.googleapis.com/projects/<project_number>/locations/global/workloadIdentityPools/aampe-pool/subject/<aampe_subject_identifier>" \
    --role="<your_custom_role>"