Storage: pass predefinedDefaultObjectAcl on bucket creation

[thoutenbos]

Is your feature request related to a problem? Please describe.
In the Bucket creation API it's allowed to pass a query parameter "predefinedDefaultObjectAcl" to set the default object ACL in the creation call of the bucket. In the current implementation of this library it's not possible to set this query parameter as it is hardcoded to only the (required) project.

https://github.com/googleapis/google-cloud-python/blob/master/storage/google/cloud/storage/bucket.py#L637

Describe the solution you'd like
Expose the optional query parameters in this library.

Describe alternatives you've considered
Updating the predefinedDefaultObjectAcl after bucket creation requires additional permissions on the bucket that should not be needed when setting this value directly on bucket creation.

Additional context
API Reference for bucket/insert
https://cloud.google.com/storage/docs/json_api/v1/buckets/insert

[tseaver]

@thoutenbos

Updating the predefinedDefaultObjectAcl after bucket creation requires additional permissions on the bucket that should not be needed when setting this value directly on bucket creation.

Can you please clarify? I'm unaware of any case where creating a bucket would leave the creating owner without the storage.buckets.update permission required to update the default object ACL.

[tseaver]

FWIW, if we do support passing the predeinfedDefaultObjectAcl query parameter, we should also support passing predefinedAcl.

[thoutenbos]

Using a custom IAM role for a service account granting only the storage.buckets.create permission to create regular, time based, new buckets. If all needed bucket settings can be passed in the creation call then no additional permissions are needed for this service account. In the current implementation of this library the service account would need additional permissions to allow update to this (and other) buckets after creation.

The extra permissions needed to update this setting after bucket creation are:

• storage.buckets.update
• storage.buckets.getIamPolicy
• storage.buckets.setIamPolicy

From the least privilege principles granting these additional permissions is undesired when it can be avoided.

[thoutenbos]

Thanks!