[tonfa]

Can't you already do that? https://cloud.google.com/storage/docs/access-control?hl=en

[awinograd]

My understanding of the docs is you cannot do that level of fine grained access control for a given gce instance. You can only give it a gcs scope of read, write, or both