1 files changed, 18 insertions, 3 deletions
diff --git a/src/main/java/com/google/devtools/build/lib/authandtls/AuthAndTLSOptions.java b/src/main/java/com/google/devtools/build/lib/authandtls/AuthAndTLSOptions.java
index 88cae094db..2f573f964f 100644
--- a/src/main/java/com/google/devtools/build/lib/authandtls/AuthAndTLSOptions.java
+++ b/src/main/java/com/google/devtools/build/lib/authandtls/AuthAndTLSOptions.java
@@ -14,11 +14,13 @@
 
 package com.google.devtools.build.lib.authandtls;
 
+import com.google.devtools.common.options.Converters.CommaSeparatedOptionListConverter;
 import com.google.devtools.common.options.Option;
 import com.google.devtools.common.options.OptionDocumentationCategory;
 import com.google.devtools.common.options.OptionEffectTag;
 import com.google.devtools.common.options.OptionMetadataTag;
 import com.google.devtools.common.options.OptionsBase;
+import java.util.List;
 
 /**
  * Common options for authentication and TLS.
@@ -37,15 +39,28 @@ public class AuthAndTLSOptions extends OptionsBase {
   )
   public boolean authEnabled;
 
+  /**
+   * Comma-separated list of auth scopes.
+   *
+   * <ul>
+   *   <li><b>https://www.googleapis.com/auth/cloud-source-tools</b> is the auth scope for Build
+   *       Event Service (BES) and Remote Build Execution (RBE).
+   *   <li><b>https://www.googleapis.com/auth/devstorage.read_write</b> is the auth scope for Google
+   *       Cloud Storage (GCS).
+   * </ul>
+   */
   @Option(
     name = "auth_scope",
-    defaultValue = "https://www.googleapis.com/auth/cloud-source-tools",
+    defaultValue =
+        "https://www.googleapis.com/auth/cloud-source-tools,"
+            + "https://www.googleapis.com/auth/devstorage.read_write",
+    converter = CommaSeparatedOptionListConverter.class,
     category = "remote",
     documentationCategory = OptionDocumentationCategory.UNCATEGORIZED,
     effectTags = {OptionEffectTag.UNKNOWN},
-    help = "If server authentication requires a scope, provide it here."
+    help = "A comma-separated list of authentication scopes."
   )
-  public String authScope;
+  public List<String> authScope;
 
   @Option(
     name = "auth_credentials",