I am using Google.Cloud.Storage.V1 nuget for communication with Google Cloud storage from my C# api. I have setup a service account and use json key for auth. I have enabled object level retention policy, so I can set retention period for each object individually, but I can’t remove or shorten the period with unlocked retention mode (API returns 403). Service account has Storage Admin and Storage Object Admin roles, so required permission according to docs is applied (“storage.objects.overrideUnlockedRetention”). Also made sure that this permission is granted by using “Policy Troubleshooter”.

This is the code used for updating retention period. Resetting retention with shorter time fails with 403 and error message “The service storage has thrown an exception. HttpStatusCode is Forbidden. The unlocked object retention cannot be removed and its retention period cannot be shortened without overriding unlocked retention intent and permission.”

var storage = await StorageClient.CreateAsync(GoogleCredential.FromJsonParameters(new JsonCredentialParameters() { ...}));

var objectMetadata = await storage.GetObjectAsync(bucketName, objectName);
objectMetadata.Retention = new GoogleObject.RetentionData { RetainUntilTimeDateTimeOffset = DateTimeOffset.UtcNow.Add(duration), Mode = "Unlocked" };

await storage.PatchObjectAsync(objectMetadata);

I have tried multiple roles, even “Owner”. From google cloud console I can shorten or remove the period with owner account. But from cloud console it calls different API, so I can’t really inspect differences between it and the call made from C# API using Google.Cloud.Storage.V1