Added storage bucket tests.

README.md

@@ -121,7 +121,7 @@ The PEM files must contain only the certificate block. A trailing newline after
 
 ## 3. Create the pool, provider and credentials
 
-The script creates the workload identity pool, the X.509 provider and a service account. It allows the client certificate subject to impersonate the service account, grants the service account read access to the project, and writes `cred.json`. It then logs in with `cred.json` and checks the access.
+The script creates the workload identity pool, the X.509 provider and a service account. It allows the client certificate subject to impersonate the service account, grants the service account read access to the project, creates a storage bucket with read and write access to its objects for the service account, and writes `cred.json`. It then logs in with `cred.json` and checks the access.
 
 ```bash
 # Create a workload identity pool and a X.509 provider
@@ -154,6 +154,17 @@ gcloud projects add-iam-policy-binding my-project \
     --member="serviceAccount:sa-test@my-project.iam.gserviceaccount.com" \
     --role=roles/browser
 
+# Create a storage bucket
+gcloud storage buckets create gs://my-project-wif-test \
+    --project=my-project \
+    --location=europe-central2 \
+    --uniform-bucket-level-access
+
+# Allow the service account to read and write objects in the bucket
+gcloud storage buckets add-iam-policy-binding gs://my-project-wif-test \
+    --member="serviceAccount:sa-test@my-project.iam.gserviceaccount.com" \
+    --role=roles/storage.objectUser
+
 # Create credentials configuration files
 gcloud iam workload-identity-pools create-cred-config \
     projects/123456789012/locations/global/workloadIdentityPools/my-pool/providers/my-x509 \