Not able to see all the members when getting list of IAM users for a bucket - google-cloud-storage

Question

I am trying to get list of all the IAM users having access to a particular bucket with the below command:
gsutil iam get gs://<bucket_name>
I am getting output with only legacy roles:
{
"bindings": [
{
"members": [
"projectEditor:PROJECT_ID",
"projectOwner:PROJECT_ID"
],
"role": "roles/storage.legacyBucketOwner"
},
{
"members": [
"projectViewer:PROJECT_ID"
],
"role": "roles/storage.legacyBucketReader"
},
{
"members": [
"projectEditor:PROJECT_ID",
"projectOwner:PROJECT_ID"
],
"role": "roles/storage.legacyObjectOwner"
},
{
"members": [
"projectViewer:PROJECT_ID"
],
"role": "roles/storage.legacyObjectReader"
}
],
"etag": "CAE="
}
However, I do have additional users and service accounts that have access to this bucket. How do I get list of all the users and service accounts having access to the bucket?
P.S: All the permissions over the bucket to different users are provided through IAM only.

Answer 1

Looks like policy analyzer tool provides the required information.
https://cloud.google.com/asset-inventory/docs/analyzing-iam-policy
Code sample: https://github.com/googleapis/python-asset/blob/dd28cb0dd897d9386c45a4ec4d4ce8090d986052/samples/snippets/quickstart_analyzeiampolicy.py
However, the question is why
gsutil iam get gs://BUCKET
is not returning all the roles and members that have access to bucket? Is there any additional flag or configuration that needs to be passed to the above command.