diff --git a/api/workers/remote_storage_permissions.gen.go b/api/workers/remote_storage_permissions.gen.go
new file mode 100644
index 0000000000..9788932fd4
--- /dev/null
+++ b/api/workers/remote_storage_permissions.gen.go
@@ -0,0 +1,11 @@
+// Code generated by "make api"; DO NOT EDIT.
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package workers
+
+type RemoteStoragePermissions struct {
+	Write  string `json:"write,omitempty"`
+	Read   string `json:"read,omitempty"`
+	Delete string `json:"delete,omitempty"`
+}
diff --git a/api/workers/remote_storage_state.gen.go b/api/workers/remote_storage_state.gen.go
new file mode 100644
index 0000000000..39318cdc7c
--- /dev/null
+++ b/api/workers/remote_storage_state.gen.go
@@ -0,0 +1,10 @@
+// Code generated by "make api"; DO NOT EDIT.
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package workers
+
+type RemoteStorageState struct {
+	Status      string                    `json:"status,omitempty"`
+	Permissions *RemoteStoragePermissions `json:"permissions,omitempty"`
+}
diff --git a/api/workers/worker.gen.go b/api/workers/worker.gen.go
index ee998588e9..9fc4241f3e 100644
--- a/api/workers/worker.gen.go
+++ b/api/workers/worker.gen.go
@@ -18,27 +18,28 @@ import (
 )
 
 type Worker struct {
-	Id                                 string              `json:"id,omitempty"`
-	ScopeId                            string              `json:"scope_id,omitempty"`
-	Scope                              *scopes.ScopeInfo   `json:"scope,omitempty"`
-	Name                               string              `json:"name,omitempty"`
-	Description                        string              `json:"description,omitempty"`
-	CreatedTime                        time.Time           `json:"created_time,omitempty"`
-	UpdatedTime                        time.Time           `json:"updated_time,omitempty"`
-	Version                            uint32              `json:"version,omitempty"`
-	Address                            string              `json:"address,omitempty"`
-	CanonicalTags                      map[string][]string `json:"canonical_tags,omitempty"`
-	ConfigTags                         map[string][]string `json:"config_tags,omitempty"`
-	LastStatusTime                     time.Time           `json:"last_status_time,omitempty"`
-	WorkerGeneratedAuthToken           string              `json:"worker_generated_auth_token,omitempty"`
-	ControllerGeneratedActivationToken string              `json:"controller_generated_activation_token,omitempty"`
-	ActiveConnectionCount              uint32              `json:"active_connection_count,omitempty"`
-	Type                               string              `json:"type,omitempty"`
-	ApiTags                            map[string][]string `json:"api_tags,omitempty"`
-	ReleaseVersion                     string              `json:"release_version,omitempty"`
-	DirectlyConnectedDownstreamWorkers []string            `json:"directly_connected_downstream_workers,omitempty"`
-	AuthorizedActions                  []string            `json:"authorized_actions,omitempty"`
-	LocalStorageState                  string              `json:"local_storage_state,omitempty"`
+	Id                                 string                        `json:"id,omitempty"`
+	ScopeId                            string                        `json:"scope_id,omitempty"`
+	Scope                              *scopes.ScopeInfo             `json:"scope,omitempty"`
+	Name                               string                        `json:"name,omitempty"`
+	Description                        string                        `json:"description,omitempty"`
+	CreatedTime                        time.Time                     `json:"created_time,omitempty"`
+	UpdatedTime                        time.Time                     `json:"updated_time,omitempty"`
+	Version                            uint32                        `json:"version,omitempty"`
+	Address                            string                        `json:"address,omitempty"`
+	CanonicalTags                      map[string][]string           `json:"canonical_tags,omitempty"`
+	ConfigTags                         map[string][]string           `json:"config_tags,omitempty"`
+	LastStatusTime                     time.Time                     `json:"last_status_time,omitempty"`
+	WorkerGeneratedAuthToken           string                        `json:"worker_generated_auth_token,omitempty"`
+	ControllerGeneratedActivationToken string                        `json:"controller_generated_activation_token,omitempty"`
+	ActiveConnectionCount              uint32                        `json:"active_connection_count,omitempty"`
+	Type                               string                        `json:"type,omitempty"`
+	ApiTags                            map[string][]string           `json:"api_tags,omitempty"`
+	ReleaseVersion                     string                        `json:"release_version,omitempty"`
+	DirectlyConnectedDownstreamWorkers []string                      `json:"directly_connected_downstream_workers,omitempty"`
+	AuthorizedActions                  []string                      `json:"authorized_actions,omitempty"`
+	LocalStorageState                  string                        `json:"local_storage_state,omitempty"`
+	RemoteStorageState                 map[string]RemoteStorageState `json:"remote_storage_state,omitempty"`
 }
 
 type WorkerReadResult struct {
diff --git a/globals/fields.go b/globals/fields.go
index e0b7cd75c6..ea6a546cce 100644
--- a/globals/fields.go
+++ b/globals/fields.go
@@ -123,4 +123,5 @@ const (
 	ValueField                                  = "value"
 	WithAliasesField                            = "with_aliases"
 	LocalStorageStateField                      = "local_storage_state"
+	RemoteStorageStateField                     = "remote_storage_state"
 )
diff --git a/internal/api/genapi/input.go b/internal/api/genapi/input.go
index d34dbc2887..5e9291f32f 100644
--- a/internal/api/genapi/input.go
+++ b/internal/api/genapi/input.go
@@ -1352,6 +1352,14 @@ var inputStructs = []*structInfo{
 		inProto: &workers.Certificate{},
 		outFile: "workers/certificate.gen.go",
 	},
+	{
+		inProto: &workers.RemoteStorageState{},
+		outFile: "workers/remote_storage_state.gen.go",
+	},
+	{
+		inProto: &workers.RemoteStoragePermissions{},
+		outFile: "workers/remote_storage_permissions.gen.go",
+	},
 	{
 		inProto:             &workers.CertificateAuthority{},
 		outFile:             "workers/certificate_authority.gen.go",
@@ -1408,6 +1416,13 @@ var inputStructs = []*structInfo{
 				VarName:   "apiTags",
 			},
 		},
+		fieldOverrides: []fieldInfo{
+			{
+				Name:      "RemoteStorageState",
+				ProtoName: "remote_storage_state",
+				FieldType: "map[string]RemoteStorageState",
+			},
+		},
 		createResponseTypes: []string{CreateResponseType, ReadResponseType, UpdateResponseType, DeleteResponseType, ListResponseType},
 		recursiveListing:    true,
 		versionEnabled:      true,
diff --git a/internal/daemon/controller/handlers/workers/worker_service.go b/internal/daemon/controller/handlers/workers/worker_service.go
index 71703e5088..66eb374f71 100644
--- a/internal/daemon/controller/handlers/workers/worker_service.go
+++ b/internal/daemon/controller/handlers/workers/worker_service.go
@@ -27,6 +27,7 @@ import (
 	"github.com/hashicorp/boundary/internal/types/scope"
 	"github.com/hashicorp/boundary/internal/util"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/workers"
+	"github.com/hashicorp/boundary/sdk/pbs/plugin"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/nodeenrollment/types"
 	"github.com/mr-tron/base58"
@@ -924,10 +925,67 @@ func (s Service) toProto(ctx context.Context, in *server.Worker, opt ...handlers
 			return nil, errors.Wrap(ctx, err, op, errors.WithMsg("error preparing canonical tags proto"))
 		}
 	}
-
+	if outputFields.Has(globals.RemoteStorageStateField) && len(in.RemoteStorageStates) > 0 {
+		var err error
+		out.RemoteStorageState, err = remoteStorageStatesToMapProto(in.RemoteStorageStates)
+		if err != nil {
+			return nil, errors.Wrap(ctx, err, op, errors.WithMsg("error preparing remote storage state proto"))
+		}
+	}
 	return &out, nil
 }
 
+func remoteStorageStatesToMapProto(in map[string]*plugin.StorageBucketCredentialState) (map[string]*pb.RemoteStorageState, error) {
+	ret := make(map[string]*pb.RemoteStorageState)
+	for storageBucketId, sbcState := range in {
+		status := server.RemoteStorageStateAvailable
+		writeState := server.PermissionStateUnknown.String()
+		readState := server.PermissionStateUnknown.String()
+		deleteState := server.PermissionStateUnknown.String()
+		if sbcState.GetState() != nil {
+			if sbcState.GetState().GetWrite() != nil {
+				writePermissionState, err := server.ParsePermissionState(sbcState.GetState().GetWrite().GetState())
+				if err != nil {
+					return nil, err
+				}
+				writeState = writePermissionState
+				if writeState == server.PermissionStateError.String() {
+					status = server.RemoteStorageStateError
+				}
+			}
+			if sbcState.GetState().GetRead() != nil {
+				readPermissionState, err := server.ParsePermissionState(sbcState.GetState().GetRead().GetState())
+				if err != nil {
+					return nil, err
+				}
+				readState = readPermissionState
+				if readState == server.PermissionStateError.String() {
+					status = server.RemoteStorageStateError
+				}
+			}
+			if sbcState.GetState().GetDelete() != nil {
+				deletePermissionState, err := server.ParsePermissionState(sbcState.GetState().GetDelete().GetState())
+				if err != nil {
+					return nil, err
+				}
+				deleteState = deletePermissionState
+				if deleteState == server.PermissionStateError.String() {
+					status = server.RemoteStorageStateError
+				}
+			}
+		}
+		ret[storageBucketId] = &pb.RemoteStorageState{
+			Status: status.String(),
+			Permissions: &pb.RemoteStoragePermissions{
+				Write:  writeState,
+				Read:   readState,
+				Delete: deleteState,
+			},
+		}
+	}
+	return ret, nil
+}
+
 func tagsToMapProto(in map[string][]string) (map[string]*structpb.ListValue, error) {
 	b := make(map[string][]any)
 	for k, v := range in {
diff --git a/internal/daemon/controller/handlers/workers/worker_service_test.go b/internal/daemon/controller/handlers/workers/worker_service_test.go
index 489daab099..d5157e8214 100644
--- a/internal/daemon/controller/handlers/workers/worker_service_test.go
+++ b/internal/daemon/controller/handlers/workers/worker_service_test.go
@@ -9,6 +9,7 @@ import (
 	"sort"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
@@ -26,6 +27,7 @@ import (
 	"github.com/hashicorp/boundary/internal/types/scope"
 	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes"
 	pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/workers"
+	"github.com/hashicorp/boundary/sdk/pbs/plugin"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/nodeenrollment"
 	"github.com/hashicorp/nodeenrollment/rotation"
@@ -1597,6 +1599,7 @@ func TestCreateWorkerLed(t *testing.T) {
 					tc.res.Item.Scope = got.GetItem().Scope
 					tc.res.Item.AuthorizedActions = got.GetItem().GetAuthorizedActions()
 					tc.res.Item.LocalStorageState = got.GetItem().GetLocalStorageState()
+					tc.res.Item.DirectlyConnectedDownstreamWorkers = got.GetItem().GetDirectlyConnectedDownstreamWorkers()
 				}
 			}
 			assert.Equal(tc.res, got)
@@ -1945,6 +1948,7 @@ func TestCreateControllerLed(t *testing.T) {
 					tc.res.Item.AuthorizedActions = got.GetItem().GetAuthorizedActions()
 					tc.res.Item.ControllerGeneratedActivationToken = got.GetItem().GetControllerGeneratedActivationToken()
 					tc.res.Item.LocalStorageState = got.GetItem().GetLocalStorageState()
+					tc.res.Item.DirectlyConnectedDownstreamWorkers = got.GetItem().GetDirectlyConnectedDownstreamWorkers()
 				}
 			}
 			assert.Equal(tc.res, got)
@@ -2619,3 +2623,211 @@ func TestReinitializeCertificateAuthority(t *testing.T) {
 		})
 	}
 }
+
+func Test_RemoteStorageStatesToMapProto(t *testing.T) {
+	t.Parallel()
+	testTime := timestamppb.New(time.Now().UTC().Round(time.Second))
+	tests := []struct {
+		name           string
+		input          map[string]*plugin.StorageBucketCredentialState
+		expectedErrMsg string
+		expectedOutput map[string]*pb.RemoteStorageState
+	}{
+		{
+			name:           "nil",
+			expectedOutput: map[string]*pb.RemoteStorageState{},
+		},
+		{
+			name:           "empty",
+			expectedOutput: map[string]*pb.RemoteStorageState{},
+		},
+		{
+			name: "available",
+			input: map[string]*plugin.StorageBucketCredentialState{
+				"sb_1234567890": {
+					State: &plugin.Permissions{
+						Write: &plugin.Permission{
+							State:     plugin.StateType_STATE_TYPE_OK,
+							CheckedAt: testTime,
+						},
+						Read: &plugin.Permission{
+							State:     plugin.StateType_STATE_TYPE_OK,
+							CheckedAt: testTime,
+						},
+						Delete: &plugin.Permission{
+							State:     plugin.StateType_STATE_TYPE_OK,
+							CheckedAt: testTime,
+						},
+					},
+					Version: 1,
+				},
+			},
+			expectedOutput: map[string]*pb.RemoteStorageState{
+				"sb_1234567890": {
+					Status: "available",
+					Permissions: &pb.RemoteStoragePermissions{
+						Write:  "ok",
+						Read:   "ok",
+						Delete: "ok",
+					},
+				},
+			},
+		},
+		{
+			name: "write error",
+			input: map[string]*plugin.StorageBucketCredentialState{
+				"sb_1234567890": {
+					State: &plugin.Permissions{
+						Write: &plugin.Permission{
+							State:        plugin.StateType_STATE_TYPE_ERROR,
+							ErrorDetails: "invalid credentials",
+							CheckedAt:    testTime,
+						},
+						Read: &plugin.Permission{
+							State:     plugin.StateType_STATE_TYPE_OK,
+							CheckedAt: testTime,
+						},
+						Delete: &plugin.Permission{
+							State:     plugin.StateType_STATE_TYPE_OK,
+							CheckedAt: testTime,
+						},
+					},
+					Version: 1,
+				},
+			},
+			expectedOutput: map[string]*pb.RemoteStorageState{
+				"sb_1234567890": {
+					Status: "error",
+					Permissions: &pb.RemoteStoragePermissions{
+						Write:  "error",
+						Read:   "ok",
+						Delete: "ok",
+					},
+				},
+			},
+		},
+		{
+			name: "read error",
+			input: map[string]*plugin.StorageBucketCredentialState{
+				"sb_1234567890": {
+					State: &plugin.Permissions{
+						Write: &plugin.Permission{
+							State:     plugin.StateType_STATE_TYPE_OK,
+							CheckedAt: testTime,
+						},
+						Read: &plugin.Permission{
+							State:        plugin.StateType_STATE_TYPE_ERROR,
+							ErrorDetails: "invalid credentials",
+							CheckedAt:    testTime,
+						},
+						Delete: &plugin.Permission{
+							State:     plugin.StateType_STATE_TYPE_OK,
+							CheckedAt: testTime,
+						},
+					},
+					Version: 1,
+				},
+			},
+			expectedOutput: map[string]*pb.RemoteStorageState{
+				"sb_1234567890": {
+					Status: "error",
+					Permissions: &pb.RemoteStoragePermissions{
+						Write:  "ok",
+						Read:   "error",
+						Delete: "ok",
+					},
+				},
+			},
+		},
+		{
+			name: "delete error",
+			input: map[string]*plugin.StorageBucketCredentialState{
+				"sb_1234567890": {
+					State: &plugin.Permissions{
+						Write: &plugin.Permission{
+							State:     plugin.StateType_STATE_TYPE_OK,
+							CheckedAt: testTime,
+						},
+						Read: &plugin.Permission{
+							State:     plugin.StateType_STATE_TYPE_OK,
+							CheckedAt: testTime,
+						},
+						Delete: &plugin.Permission{
+							State:        plugin.StateType_STATE_TYPE_ERROR,
+							ErrorDetails: "invalid credentials",
+							CheckedAt:    testTime,
+						},
+					},
+					Version: 1,
+				},
+			},
+			expectedOutput: map[string]*pb.RemoteStorageState{
+				"sb_1234567890": {
+					Status: "error",
+					Permissions: &pb.RemoteStoragePermissions{
+						Write:  "ok",
+						Read:   "ok",
+						Delete: "error",
+					},
+				},
+			},
+		},
+		{
+			name: "error",
+			input: map[string]*plugin.StorageBucketCredentialState{
+				"sb_1234567890": {
+					State: &plugin.Permissions{
+						Write: &plugin.Permission{
+							State:        plugin.StateType_STATE_TYPE_ERROR,
+							ErrorDetails: "invalid credentials",
+							CheckedAt:    testTime,
+						},
+						Read: &plugin.Permission{
+							State:        plugin.StateType_STATE_TYPE_ERROR,
+							ErrorDetails: "invalid credentials",
+							CheckedAt:    testTime,
+						},
+						Delete: &plugin.Permission{
+							State:        plugin.StateType_STATE_TYPE_ERROR,
+							ErrorDetails: "invalid credentials",
+							CheckedAt:    testTime,
+						},
+					},
+					Version: 1,
+				},
+			},
+			expectedOutput: map[string]*pb.RemoteStorageState{
+				"sb_1234567890": {
+					Status: "error",
+					Permissions: &pb.RemoteStoragePermissions{
+						Write:  "error",
+						Read:   "error",
+						Delete: "error",
+					},
+				},
+			},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			require, assert := require.New(t), assert.New(t)
+			actualOutput, err := remoteStorageStatesToMapProto(tc.input)
+			if tc.expectedErrMsg != "" {
+				require.Error(err)
+				assert.ErrorContains(err, tc.expectedErrMsg)
+				assert.Nil(actualOutput)
+				return
+			}
+			require.NoError(err)
+			require.Len(actualOutput, len(tc.expectedOutput))
+			for storageBucketId, expectedState := range tc.expectedOutput {
+				actualState, ok := actualOutput[storageBucketId]
+				require.True(ok)
+				assert.Equal(expectedState.GetStatus(), actualState.GetStatus())
+				assert.Equal(expectedState.GetPermissions().GetWrite(), actualState.GetPermissions().GetWrite())
+				assert.Equal(expectedState.GetPermissions().GetRead(), actualState.GetPermissions().GetRead())
+				assert.Equal(expectedState.GetPermissions().GetDelete(), actualState.GetPermissions().GetDelete())
+			}
+		})
+	}
+}
diff --git a/internal/gen/controller.swagger.json b/internal/gen/controller.swagger.json
index b4d7bfa834..39241cb453 100644
--- a/internal/gen/controller.swagger.json
+++ b/internal/gen/controller.swagger.json
@@ -8458,6 +8458,41 @@
         }
       }
     },
+    "controller.api.resources.workers.v1.RemoteStoragePermissions": {
+      "type": "object",
+      "properties": {
+        "write": {
+          "type": "string",
+          "description": "Output only. The status of the write permission state for the given storage bucket.\nPossible values are: unknown, error, and ok.",
+          "readOnly": true
+        },
+        "read": {
+          "type": "string",
+          "description": "Output only. The status of the read permission state for the given storage bucket.\nPossible values are: unknown, error, and ok.",
+          "readOnly": true
+        },
+        "delete": {
+          "type": "string",
+          "description": "Output only. The status of the delete permission state for the given storage bucket.\nPossible values are: unknown, error, and ok.",
+          "readOnly": true
+        }
+      }
+    },
+    "controller.api.resources.workers.v1.RemoteStorageState": {
+      "type": "object",
+      "properties": {
+        "status": {
+          "type": "string",
+          "description": "Output only. The overall health status of the storage bucket. The possible values include: error and available.\nThe status exists in an available state if each remote storage permission state does not have an error. An unknown remote\nstorage permission state does not affect the overall health status.",
+          "readOnly": true
+        },
+        "permissions": {
+          "$ref": "#/definitions/controller.api.resources.workers.v1.RemoteStoragePermissions",
+          "description": "Output only. The remote storage permissions contains the permission state for each individual permission type.",
+          "readOnly": true
+        }
+      }
+    },
     "controller.api.resources.workers.v1.Worker": {
       "type": "object",
       "properties": {
@@ -8591,6 +8626,14 @@
           "description": "",
           "title": "Output only. The local_storage_state indicates the state of the local disk space of the worker.\nPossible values are:\n- available: The worker local storage state is at an acceptable state\n- low storage: The worker is below the minimum threshold for local storage\n- critically low storage: The worker local storage state is below the critical minimum threshold for local storage\n- out of storage: The worker is out of local disk space\n- not configured: The worker does not have a local storage path configured\n- unknown: The default local storage state of a worker. Used when the local storage state of a worker is not yet known",
           "readOnly": true
+        },
+        "remote_storage_state": {
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/controller.api.resources.workers.v1.RemoteStorageState"
+          },
+          "description": "Output only. The remote_storage_state indicats the permission state of the storage buckets that the Worker\nis actively using. The possible permission state types include: write, read, and delete. The possible\npermission state values include: unknown, error, and ok.",
+          "readOnly": true
         }
       },
       "title": "Worker contains all fields related to a Worker resource"
diff --git a/internal/proto/controller/api/resources/workers/v1/worker.proto b/internal/proto/controller/api/resources/workers/v1/worker.proto
index 4a55701d26..bf05b9f6da 100644
--- a/internal/proto/controller/api/resources/workers/v1/worker.proto
+++ b/internal/proto/controller/api/resources/workers/v1/worker.proto
@@ -107,6 +107,35 @@ message Worker {
   // - not configured: The worker does not have a local storage path configured
   // - unknown: The default local storage state of a worker. Used when the local storage state of a worker is not yet known
   string local_storage_state = 310 [json_name = "local_storage_state"]; // @gotags: `class:"public"`
+
+  // Output only. The remote_storage_state indicats the permission state of the storage buckets that the Worker
+  // is actively using. The possible permission state types include: write, read, and delete. The possible
+  // permission state values include: unknown, error, and ok.
+  map<string, RemoteStorageState> remote_storage_state = 320 [json_name = "remote_storage_state"]; // @gotags: `class:"public"`
+}
+
+message RemoteStorageState {
+  // Output only. The overall health status of the storage bucket. The possible values include: error and available.
+  // The status exists in an available state if each remote storage permission state does not have an error. An unknown remote
+  // storage permission state does not affect the overall health status.
+  string status = 10; // @gotags: `class:"public"`
+
+  // Output only. The remote storage permissions contains the permission state for each individual permission type.
+  RemoteStoragePermissions permissions = 20; // @gotags: `class:"public"`
+}
+
+message RemoteStoragePermissions {
+  // Output only. The status of the write permission state for the given storage bucket.
+  // Possible values are: unknown, error, and ok.
+  string write = 10; // @gotags: `class:"public"`
+
+  // Output only. The status of the read permission state for the given storage bucket.
+  // Possible values are: unknown, error, and ok.
+  string read = 20; // @gotags: `class:"public"`
+
+  // Output only. The status of the delete permission state for the given storage bucket.
+  // Possible values are: unknown, error, and ok.
+  string delete = 30; // @gotags: `class:"public"`
 }
 
 message Certificate {
diff --git a/internal/server/repository_worker.go b/internal/server/repository_worker.go
index ba5725db33..cee85974b7 100644
--- a/internal/server/repository_worker.go
+++ b/internal/server/repository_worker.go
@@ -77,6 +77,13 @@ func (r *Repository) LookupWorkerByName(ctx context.Context, name string) (*Work
 	if err != nil {
 		return nil, errors.Wrap(ctx, err, op)
 	}
+	if w == nil {
+		return nil, nil
+	}
+	w.RemoteStorageStates, err = r.ListWorkerStorageBucketCredentialState(ctx, w.GetPublicId())
+	if err != nil {
+		return nil, errors.Wrap(ctx, err, op)
+	}
 	return w, nil
 }
 
@@ -138,6 +145,13 @@ func (r *Repository) LookupWorker(ctx context.Context, publicId string, _ ...Opt
 	if err != nil {
 		return nil, errors.Wrap(ctx, err, op)
 	}
+	if w == nil {
+		return nil, nil
+	}
+	w.RemoteStorageStates, err = r.ListWorkerStorageBucketCredentialState(ctx, w.GetPublicId())
+	if err != nil {
+		return nil, errors.Wrap(ctx, err, op)
+	}
 	return w, nil
 }
 
@@ -555,6 +569,10 @@ func (r *Repository) UpdateWorker(ctx context.Context, worker *Worker, version u
 			if ret, err = wAgg.toWorker(ctx); err != nil {
 				return err
 			}
+			ret.RemoteStorageStates, err = r.ListWorkerStorageBucketCredentialState(ctx, ret.GetPublicId())
+			if err != nil {
+				return err
+			}
 			return nil
 		},
 	)
diff --git a/internal/server/worker.go b/internal/server/worker.go
index 6b57c4b1ac..307f6343d6 100644
--- a/internal/server/worker.go
+++ b/internal/server/worker.go
@@ -11,6 +11,7 @@ import (
 	"github.com/hashicorp/boundary/internal/db/timestamp"
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/server/store"
+	"github.com/hashicorp/boundary/sdk/pbs/plugin"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/structpb"
 )
@@ -126,6 +127,9 @@ type Worker struct {
 
 	// This is used to pass the token back to the calling function
 	ControllerGeneratedActivationToken string `gorm:"-"`
+
+	// RemoteStorageStates is a map of storage buckets and their storage bucket credential states
+	RemoteStorageStates map[string]*plugin.StorageBucketCredentialState `gorm:"-"`
 }
 
 // NewWorker returns a new Worker. Valid options are WithName, WithDescription
@@ -284,6 +288,7 @@ func (a *workerAggregate) toWorker(ctx context.Context) (*Worker, error) {
 			LocalStorageState: a.LocalStorageState,
 		},
 		activeConnectionCount: a.ActiveConnectionCount,
+		RemoteStorageStates:   map[string]*plugin.StorageBucketCredentialState{},
 	}
 	tags, err := tagsFromAggregatedTagString(ctx, a.ApiTags)
 	if err != nil {
diff --git a/internal/server/worker_storage_bucket_credential_state.go b/internal/server/worker_storage_bucket_credential_state.go
new file mode 100644
index 0000000000..07d8400672
--- /dev/null
+++ b/internal/server/worker_storage_bucket_credential_state.go
@@ -0,0 +1,76 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package server
+
+import (
+	"fmt"
+
+	plgpb "github.com/hashicorp/boundary/sdk/pbs/plugin"
+)
+
+type RemoteStorageState string
+
+const (
+	RemoteStorageStateAvailable RemoteStorageState = "available"
+	RemoteStorageStateError     RemoteStorageState = "error"
+	RemoteStorageStateUnknown   RemoteStorageState = "unknown"
+)
+
+func (t RemoteStorageState) String() string {
+	switch t {
+	case RemoteStorageStateAvailable, RemoteStorageStateError:
+		return string(t)
+	}
+	return string(RemoteStorageStateUnknown)
+}
+
+type StorageBucketCredentialPermissionType string
+
+func (s StorageBucketCredentialPermissionType) String() string {
+	return string(s)
+}
+
+type StorageBucketCredentialPermissionState string
+
+func (s StorageBucketCredentialPermissionState) String() string {
+	return string(s)
+}
+
+// ParseStateType converts the string value of a storage bucket credential
+// state value and converts it into a integer type.
+func ParseStateType(s string) (plgpb.StateType, error) {
+	switch s {
+	case PermissionStateOk.String():
+		return plgpb.StateType_STATE_TYPE_OK, nil
+	case PermissionStateError.String():
+		return plgpb.StateType_STATE_TYPE_ERROR, nil
+	case PermissionStateUnknown.String():
+		return plgpb.StateType_STATE_TYPE_UNKNOWN, nil
+	default:
+		return plgpb.StateType_STATE_TYPE_UNSPECIFIED, fmt.Errorf("undefined state value")
+	}
+}
+
+// ParsePermissionState converts the state type value into a string value.
+func ParsePermissionState(s plgpb.StateType) (string, error) {
+	switch s {
+	case plgpb.StateType_STATE_TYPE_OK:
+		return PermissionStateOk.String(), nil
+	case plgpb.StateType_STATE_TYPE_ERROR:
+		return PermissionStateError.String(), nil
+	case plgpb.StateType_STATE_TYPE_UNKNOWN:
+		return PermissionStateUnknown.String(), nil
+	default:
+		return "", fmt.Errorf("undefined state type")
+	}
+}
+
+const (
+	PermissionTypeWrite    StorageBucketCredentialPermissionType  = "write"
+	PermissionTypeRead     StorageBucketCredentialPermissionType  = "read"
+	PermissionTypeDelete   StorageBucketCredentialPermissionType  = "delete"
+	PermissionStateOk      StorageBucketCredentialPermissionState = "ok"
+	PermissionStateError   StorageBucketCredentialPermissionState = "error"
+	PermissionStateUnknown StorageBucketCredentialPermissionState = "unknown"
+)
diff --git a/sdk/pbs/controller/api/resources/workers/worker.pb.go b/sdk/pbs/controller/api/resources/workers/worker.pb.go
index ba6434a659..2c960af3f3 100644
--- a/sdk/pbs/controller/api/resources/workers/worker.pb.go
+++ b/sdk/pbs/controller/api/resources/workers/worker.pb.go
@@ -94,6 +94,10 @@ type Worker struct {
 	// - not configured: The worker does not have a local storage path configured
 	// - unknown: The default local storage state of a worker. Used when the local storage state of a worker is not yet known
 	LocalStorageState string `protobuf:"bytes,310,opt,name=local_storage_state,proto3" json:"local_storage_state,omitempty" class:"public"` // @gotags: `class:"public"`
+	// Output only. The remote_storage_state indicats the permission state of the storage buckets that the Worker
+	// is actively using. The possible permission state types include: write, read, and delete. The possible
+	// permission state values include: unknown, error, and ok.
+	RemoteStorageState map[string]*RemoteStorageState `protobuf:"bytes,320,rep,name=remote_storage_state,proto3" json:"remote_storage_state,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3" class:"public"` // @gotags: `class:"public"`
 }
 
 func (x *Worker) Reset() {
@@ -275,6 +279,141 @@ func (x *Worker) GetLocalStorageState() string {
 	return ""
 }
 
+func (x *Worker) GetRemoteStorageState() map[string]*RemoteStorageState {
+	if x != nil {
+		return x.RemoteStorageState
+	}
+	return nil
+}
+
+type RemoteStorageState struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Output only. The overall health status of the storage bucket. The possible values include: error and available.
+	// The status exists in an available state if each remote storage permission state does not have an error. An unknown remote
+	// storage permission state does not affect the overall health status.
+	Status string `protobuf:"bytes,10,opt,name=status,proto3" json:"status,omitempty" class:"public"` // @gotags: `class:"public"`
+	// Output only. The remote storage permissions contains the permission state for each individual permission type.
+	Permissions *RemoteStoragePermissions `protobuf:"bytes,20,opt,name=permissions,proto3" json:"permissions,omitempty" class:"public"` // @gotags: `class:"public"`
+}
+
+func (x *RemoteStorageState) Reset() {
+	*x = RemoteStorageState{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_api_resources_workers_v1_worker_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RemoteStorageState) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RemoteStorageState) ProtoMessage() {}
+
+func (x *RemoteStorageState) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_api_resources_workers_v1_worker_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RemoteStorageState.ProtoReflect.Descriptor instead.
+func (*RemoteStorageState) Descriptor() ([]byte, []int) {
+	return file_controller_api_resources_workers_v1_worker_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *RemoteStorageState) GetStatus() string {
+	if x != nil {
+		return x.Status
+	}
+	return ""
+}
+
+func (x *RemoteStorageState) GetPermissions() *RemoteStoragePermissions {
+	if x != nil {
+		return x.Permissions
+	}
+	return nil
+}
+
+type RemoteStoragePermissions struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Output only. The status of the write permission state for the given storage bucket.
+	// Possible values are: unknown, error, and ok.
+	Write string `protobuf:"bytes,10,opt,name=write,proto3" json:"write,omitempty" class:"public"` // @gotags: `class:"public"`
+	// Output only. The status of the read permission state for the given storage bucket.
+	// Possible values are: unknown, error, and ok.
+	Read string `protobuf:"bytes,20,opt,name=read,proto3" json:"read,omitempty" class:"public"` // @gotags: `class:"public"`
+	// Output only. The status of the delete permission state for the given storage bucket.
+	// Possible values are: unknown, error, and ok.
+	Delete string `protobuf:"bytes,30,opt,name=delete,proto3" json:"delete,omitempty" class:"public"` // @gotags: `class:"public"`
+}
+
+func (x *RemoteStoragePermissions) Reset() {
+	*x = RemoteStoragePermissions{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_controller_api_resources_workers_v1_worker_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RemoteStoragePermissions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RemoteStoragePermissions) ProtoMessage() {}
+
+func (x *RemoteStoragePermissions) ProtoReflect() protoreflect.Message {
+	mi := &file_controller_api_resources_workers_v1_worker_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RemoteStoragePermissions.ProtoReflect.Descriptor instead.
+func (*RemoteStoragePermissions) Descriptor() ([]byte, []int) {
+	return file_controller_api_resources_workers_v1_worker_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *RemoteStoragePermissions) GetWrite() string {
+	if x != nil {
+		return x.Write
+	}
+	return ""
+}
+
+func (x *RemoteStoragePermissions) GetRead() string {
+	if x != nil {
+		return x.Read
+	}
+	return ""
+}
+
+func (x *RemoteStoragePermissions) GetDelete() string {
+	if x != nil {
+		return x.Delete
+	}
+	return ""
+}
+
 type Certificate struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -293,7 +432,7 @@ type Certificate struct {
 func (x *Certificate) Reset() {
 	*x = Certificate{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_workers_v1_worker_proto_msgTypes[1]
+		mi := &file_controller_api_resources_workers_v1_worker_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -306,7 +445,7 @@ func (x *Certificate) String() string {
 func (*Certificate) ProtoMessage() {}
 
 func (x *Certificate) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_workers_v1_worker_proto_msgTypes[1]
+	mi := &file_controller_api_resources_workers_v1_worker_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -319,7 +458,7 @@ func (x *Certificate) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Certificate.ProtoReflect.Descriptor instead.
 func (*Certificate) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_workers_v1_worker_proto_rawDescGZIP(), []int{1}
+	return file_controller_api_resources_workers_v1_worker_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *Certificate) GetId() string {
@@ -361,7 +500,7 @@ type CertificateAuthority struct {
 func (x *CertificateAuthority) Reset() {
 	*x = CertificateAuthority{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_controller_api_resources_workers_v1_worker_proto_msgTypes[2]
+		mi := &file_controller_api_resources_workers_v1_worker_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -374,7 +513,7 @@ func (x *CertificateAuthority) String() string {
 func (*CertificateAuthority) ProtoMessage() {}
 
 func (x *CertificateAuthority) ProtoReflect() protoreflect.Message {
-	mi := &file_controller_api_resources_workers_v1_worker_proto_msgTypes[2]
+	mi := &file_controller_api_resources_workers_v1_worker_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -387,7 +526,7 @@ func (x *CertificateAuthority) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CertificateAuthority.ProtoReflect.Descriptor instead.
 func (*CertificateAuthority) Descriptor() ([]byte, []int) {
-	return file_controller_api_resources_workers_v1_worker_proto_rawDescGZIP(), []int{2}
+	return file_controller_api_resources_workers_v1_worker_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *CertificateAuthority) GetCerts() []*Certificate {
@@ -417,7 +556,7 @@ var file_controller_api_resources_workers_v1_worker_proto_rawDesc = []byte{
 	0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
 	0x62, 0x75, 0x66, 0x2f, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x22, 0xfc, 0x0c, 0x0a, 0x06, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x12, 0x0e, 0x0a,
+	0x74, 0x6f, 0x22, 0xf6, 0x0e, 0x0a, 0x06, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x12, 0x0e, 0x0a,
 	0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1a, 0x0a,
 	0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52,
 	0x08, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x05, 0x73, 0x63, 0x6f,
@@ -504,48 +643,79 @@ var file_controller_api_resources_workers_v1_worker_proto_rawDesc = []byte{
 	0x13, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x5f, 0x73,
 	0x74, 0x61, 0x74, 0x65, 0x18, 0xb6, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x6c, 0x6f, 0x63,
 	0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65,
-	0x1a, 0x5c, 0x0a, 0x12, 0x43, 0x61, 0x6e, 0x6f, 0x6e, 0x69, 0x63, 0x61, 0x6c, 0x54, 0x61, 0x67,
-	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61,
-	0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x59,
-	0x0a, 0x0f, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x54, 0x61, 0x67, 0x73, 0x45, 0x6e, 0x74, 0x72,
-	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
-	0x6b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x56, 0x0a, 0x0c, 0x41, 0x70, 0x69,
-	0x54, 0x61, 0x67, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x05, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4c, 0x69, 0x73,
-	0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
-	0x01, 0x22, 0xcf, 0x01, 0x0a, 0x0b, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
-	0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
-	0x64, 0x12, 0x2a, 0x0a, 0x11, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x5f,
-	0x73, 0x68, 0x61, 0x32, 0x35, 0x36, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x70, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53, 0x68, 0x61, 0x32, 0x35, 0x36, 0x12, 0x42, 0x0a,
-	0x0f, 0x6e, 0x6f, 0x74, 0x5f, 0x62, 0x65, 0x66, 0x6f, 0x72, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65,
-	0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
-	0x6d, 0x70, 0x52, 0x0d, 0x6e, 0x6f, 0x74, 0x42, 0x65, 0x66, 0x6f, 0x72, 0x65, 0x54, 0x69, 0x6d,
-	0x65, 0x12, 0x40, 0x0a, 0x0e, 0x6e, 0x6f, 0x74, 0x5f, 0x61, 0x66, 0x74, 0x65, 0x72, 0x5f, 0x74,
-	0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
-	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x6e, 0x6f, 0x74, 0x41, 0x66, 0x74, 0x65, 0x72, 0x54,
-	0x69, 0x6d, 0x65, 0x22, 0x5e, 0x0a, 0x14, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
-	0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x46, 0x0a, 0x05, 0x63,
-	0x65, 0x72, 0x74, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x63, 0x6f, 0x6e,
-	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x2e, 0x76, 0x31,
-	0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x05, 0x63, 0x65,
-	0x72, 0x74, 0x73, 0x42, 0x50, 0x5a, 0x4e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
-	0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e,
-	0x64, 0x61, 0x72, 0x79, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x62, 0x73, 0x2f, 0x63, 0x6f, 0x6e,
-	0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x73, 0x2f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x3b, 0x77, 0x6f,
-	0x72, 0x6b, 0x65, 0x72, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x12, 0x78, 0x0a, 0x14, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x61,
+	0x67, 0x65, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0xc0, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x43, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65,
+	0x72, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x6d,
+	0x6f, 0x74, 0x65, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x52, 0x14, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x5f, 0x73, 0x74, 0x6f,
+	0x72, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x1a, 0x5c, 0x0a, 0x12, 0x43, 0x61,
+	0x6e, 0x6f, 0x6e, 0x69, 0x63, 0x61, 0x6c, 0x54, 0x61, 0x67, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x12, 0x30, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x59, 0x0a, 0x0f, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x54, 0x61, 0x67, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b,
+	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x30, 0x0a,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4c,
+	0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
+	0x02, 0x38, 0x01, 0x1a, 0x56, 0x0a, 0x0c, 0x41, 0x70, 0x69, 0x54, 0x61, 0x67, 0x73, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x7e, 0x0a, 0x17, 0x52,
+	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x53, 0x74, 0x61, 0x74,
+	0x65, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x4d, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x37, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
+	0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x73, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65,
+	0x6d, 0x6f, 0x74, 0x65, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x8d, 0x01, 0x0a, 0x12,
+	0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x53, 0x74, 0x61,
+	0x74, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x0a, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x5f, 0x0a, 0x0b, 0x70, 0x65,
+	0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x3d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x77, 0x6f, 0x72, 0x6b, 0x65,
+	0x72, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x53, 0x74, 0x6f, 0x72,
+	0x61, 0x67, 0x65, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x0b,
+	0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x5c, 0x0a, 0x18, 0x52,
+	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x50, 0x65, 0x72, 0x6d,
+	0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x77, 0x72, 0x69, 0x74, 0x65,
+	0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x77, 0x72, 0x69, 0x74, 0x65, 0x12, 0x12, 0x0a,
+	0x04, 0x72, 0x65, 0x61, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x72, 0x65, 0x61,
+	0x64, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x06, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x22, 0xcf, 0x01, 0x0a, 0x0b, 0x43, 0x65,
+	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x2a, 0x0a, 0x11, 0x70, 0x75, 0x62,
+	0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x73, 0x68, 0x61, 0x32, 0x35, 0x36, 0x18, 0x14,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53,
+	0x68, 0x61, 0x32, 0x35, 0x36, 0x12, 0x42, 0x0a, 0x0f, 0x6e, 0x6f, 0x74, 0x5f, 0x62, 0x65, 0x66,
+	0x6f, 0x72, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0d, 0x6e, 0x6f, 0x74, 0x42,
+	0x65, 0x66, 0x6f, 0x72, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x40, 0x0a, 0x0e, 0x6e, 0x6f, 0x74,
+	0x5f, 0x61, 0x66, 0x74, 0x65, 0x72, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x28, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0c, 0x6e,
+	0x6f, 0x74, 0x41, 0x66, 0x74, 0x65, 0x72, 0x54, 0x69, 0x6d, 0x65, 0x22, 0x5e, 0x0a, 0x14, 0x43,
+	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x74, 0x79, 0x12, 0x46, 0x0a, 0x05, 0x63, 0x65, 0x72, 0x74, 0x73, 0x18, 0x0a, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x77, 0x6f,
+	0x72, 0x6b, 0x65, 0x72, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69,
+	0x63, 0x61, 0x74, 0x65, 0x52, 0x05, 0x63, 0x65, 0x72, 0x74, 0x73, 0x42, 0x50, 0x5a, 0x4e, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x73, 0x64, 0x6b,
+	0x2f, 0x70, 0x62, 0x73, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f,
+	0x61, 0x70, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2f, 0x77, 0x6f,
+	0x72, 0x6b, 0x65, 0x72, 0x73, 0x3b, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x73, 0x62, 0x06, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -560,44 +730,50 @@ func file_controller_api_resources_workers_v1_worker_proto_rawDescGZIP() []byte
 	return file_controller_api_resources_workers_v1_worker_proto_rawDescData
 }
 
-var file_controller_api_resources_workers_v1_worker_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_controller_api_resources_workers_v1_worker_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
 var file_controller_api_resources_workers_v1_worker_proto_goTypes = []interface{}{
-	(*Worker)(nil),                 // 0: controller.api.resources.workers.v1.Worker
-	(*Certificate)(nil),            // 1: controller.api.resources.workers.v1.Certificate
-	(*CertificateAuthority)(nil),   // 2: controller.api.resources.workers.v1.CertificateAuthority
-	nil,                            // 3: controller.api.resources.workers.v1.Worker.CanonicalTagsEntry
-	nil,                            // 4: controller.api.resources.workers.v1.Worker.ConfigTagsEntry
-	nil,                            // 5: controller.api.resources.workers.v1.Worker.ApiTagsEntry
-	(*scopes.ScopeInfo)(nil),       // 6: controller.api.resources.scopes.v1.ScopeInfo
-	(*wrapperspb.StringValue)(nil), // 7: google.protobuf.StringValue
-	(*timestamppb.Timestamp)(nil),  // 8: google.protobuf.Timestamp
-	(*wrapperspb.UInt32Value)(nil), // 9: google.protobuf.UInt32Value
-	(*structpb.ListValue)(nil),     // 10: google.protobuf.ListValue
+	(*Worker)(nil),                   // 0: controller.api.resources.workers.v1.Worker
+	(*RemoteStorageState)(nil),       // 1: controller.api.resources.workers.v1.RemoteStorageState
+	(*RemoteStoragePermissions)(nil), // 2: controller.api.resources.workers.v1.RemoteStoragePermissions
+	(*Certificate)(nil),              // 3: controller.api.resources.workers.v1.Certificate
+	(*CertificateAuthority)(nil),     // 4: controller.api.resources.workers.v1.CertificateAuthority
+	nil,                              // 5: controller.api.resources.workers.v1.Worker.CanonicalTagsEntry
+	nil,                              // 6: controller.api.resources.workers.v1.Worker.ConfigTagsEntry
+	nil,                              // 7: controller.api.resources.workers.v1.Worker.ApiTagsEntry
+	nil,                              // 8: controller.api.resources.workers.v1.Worker.RemoteStorageStateEntry
+	(*scopes.ScopeInfo)(nil),         // 9: controller.api.resources.scopes.v1.ScopeInfo
+	(*wrapperspb.StringValue)(nil),   // 10: google.protobuf.StringValue
+	(*timestamppb.Timestamp)(nil),    // 11: google.protobuf.Timestamp
+	(*wrapperspb.UInt32Value)(nil),   // 12: google.protobuf.UInt32Value
+	(*structpb.ListValue)(nil),       // 13: google.protobuf.ListValue
 }
 var file_controller_api_resources_workers_v1_worker_proto_depIdxs = []int32{
-	6,  // 0: controller.api.resources.workers.v1.Worker.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
-	7,  // 1: controller.api.resources.workers.v1.Worker.name:type_name -> google.protobuf.StringValue
-	7,  // 2: controller.api.resources.workers.v1.Worker.description:type_name -> google.protobuf.StringValue
-	8,  // 3: controller.api.resources.workers.v1.Worker.created_time:type_name -> google.protobuf.Timestamp
-	8,  // 4: controller.api.resources.workers.v1.Worker.updated_time:type_name -> google.protobuf.Timestamp
-	3,  // 5: controller.api.resources.workers.v1.Worker.canonical_tags:type_name -> controller.api.resources.workers.v1.Worker.CanonicalTagsEntry
-	4,  // 6: controller.api.resources.workers.v1.Worker.config_tags:type_name -> controller.api.resources.workers.v1.Worker.ConfigTagsEntry
-	8,  // 7: controller.api.resources.workers.v1.Worker.last_status_time:type_name -> google.protobuf.Timestamp
-	7,  // 8: controller.api.resources.workers.v1.Worker.worker_generated_auth_token:type_name -> google.protobuf.StringValue
-	7,  // 9: controller.api.resources.workers.v1.Worker.controller_generated_activation_token:type_name -> google.protobuf.StringValue
-	9,  // 10: controller.api.resources.workers.v1.Worker.active_connection_count:type_name -> google.protobuf.UInt32Value
-	5,  // 11: controller.api.resources.workers.v1.Worker.api_tags:type_name -> controller.api.resources.workers.v1.Worker.ApiTagsEntry
-	8,  // 12: controller.api.resources.workers.v1.Certificate.not_before_time:type_name -> google.protobuf.Timestamp
-	8,  // 13: controller.api.resources.workers.v1.Certificate.not_after_time:type_name -> google.protobuf.Timestamp
-	1,  // 14: controller.api.resources.workers.v1.CertificateAuthority.certs:type_name -> controller.api.resources.workers.v1.Certificate
-	10, // 15: controller.api.resources.workers.v1.Worker.CanonicalTagsEntry.value:type_name -> google.protobuf.ListValue
-	10, // 16: controller.api.resources.workers.v1.Worker.ConfigTagsEntry.value:type_name -> google.protobuf.ListValue
-	10, // 17: controller.api.resources.workers.v1.Worker.ApiTagsEntry.value:type_name -> google.protobuf.ListValue
-	18, // [18:18] is the sub-list for method output_type
-	18, // [18:18] is the sub-list for method input_type
-	18, // [18:18] is the sub-list for extension type_name
-	18, // [18:18] is the sub-list for extension extendee
-	0,  // [0:18] is the sub-list for field type_name
+	9,  // 0: controller.api.resources.workers.v1.Worker.scope:type_name -> controller.api.resources.scopes.v1.ScopeInfo
+	10, // 1: controller.api.resources.workers.v1.Worker.name:type_name -> google.protobuf.StringValue
+	10, // 2: controller.api.resources.workers.v1.Worker.description:type_name -> google.protobuf.StringValue
+	11, // 3: controller.api.resources.workers.v1.Worker.created_time:type_name -> google.protobuf.Timestamp
+	11, // 4: controller.api.resources.workers.v1.Worker.updated_time:type_name -> google.protobuf.Timestamp
+	5,  // 5: controller.api.resources.workers.v1.Worker.canonical_tags:type_name -> controller.api.resources.workers.v1.Worker.CanonicalTagsEntry
+	6,  // 6: controller.api.resources.workers.v1.Worker.config_tags:type_name -> controller.api.resources.workers.v1.Worker.ConfigTagsEntry
+	11, // 7: controller.api.resources.workers.v1.Worker.last_status_time:type_name -> google.protobuf.Timestamp
+	10, // 8: controller.api.resources.workers.v1.Worker.worker_generated_auth_token:type_name -> google.protobuf.StringValue
+	10, // 9: controller.api.resources.workers.v1.Worker.controller_generated_activation_token:type_name -> google.protobuf.StringValue
+	12, // 10: controller.api.resources.workers.v1.Worker.active_connection_count:type_name -> google.protobuf.UInt32Value
+	7,  // 11: controller.api.resources.workers.v1.Worker.api_tags:type_name -> controller.api.resources.workers.v1.Worker.ApiTagsEntry
+	8,  // 12: controller.api.resources.workers.v1.Worker.remote_storage_state:type_name -> controller.api.resources.workers.v1.Worker.RemoteStorageStateEntry
+	2,  // 13: controller.api.resources.workers.v1.RemoteStorageState.permissions:type_name -> controller.api.resources.workers.v1.RemoteStoragePermissions
+	11, // 14: controller.api.resources.workers.v1.Certificate.not_before_time:type_name -> google.protobuf.Timestamp
+	11, // 15: controller.api.resources.workers.v1.Certificate.not_after_time:type_name -> google.protobuf.Timestamp
+	3,  // 16: controller.api.resources.workers.v1.CertificateAuthority.certs:type_name -> controller.api.resources.workers.v1.Certificate
+	13, // 17: controller.api.resources.workers.v1.Worker.CanonicalTagsEntry.value:type_name -> google.protobuf.ListValue
+	13, // 18: controller.api.resources.workers.v1.Worker.ConfigTagsEntry.value:type_name -> google.protobuf.ListValue
+	13, // 19: controller.api.resources.workers.v1.Worker.ApiTagsEntry.value:type_name -> google.protobuf.ListValue
+	1,  // 20: controller.api.resources.workers.v1.Worker.RemoteStorageStateEntry.value:type_name -> controller.api.resources.workers.v1.RemoteStorageState
+	21, // [21:21] is the sub-list for method output_type
+	21, // [21:21] is the sub-list for method input_type
+	21, // [21:21] is the sub-list for extension type_name
+	21, // [21:21] is the sub-list for extension extendee
+	0,  // [0:21] is the sub-list for field type_name
 }
 
 func init() { file_controller_api_resources_workers_v1_worker_proto_init() }
@@ -619,7 +795,7 @@ func file_controller_api_resources_workers_v1_worker_proto_init() {
 			}
 		}
 		file_controller_api_resources_workers_v1_worker_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Certificate); i {
+			switch v := v.(*RemoteStorageState); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -631,6 +807,30 @@ func file_controller_api_resources_workers_v1_worker_proto_init() {
 			}
 		}
 		file_controller_api_resources_workers_v1_worker_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RemoteStoragePermissions); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_controller_api_resources_workers_v1_worker_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Certificate); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_controller_api_resources_workers_v1_worker_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*CertificateAuthority); i {
 			case 0:
 				return &v.state
@@ -649,7 +849,7 @@ func file_controller_api_resources_workers_v1_worker_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_controller_api_resources_workers_v1_worker_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   6,
+			NumMessages:   9,
 			NumExtensions: 0,
 			NumServices:   0,
 		},