diff --git a/cmd/gateway-azure.go b/cmd/gateway-azure.go
index c012c3f5a..3c23258e7 100644
--- a/cmd/gateway-azure.go
+++ b/cmd/gateway-azure.go
@@ -20,7 +20,6 @@ import (
 	"crypto/md5"
 	"encoding/base64"
 	"encoding/hex"
-	"errors"
 	"fmt"
 	"hash"
 	"io"
@@ -169,10 +168,6 @@ func newAzureLayer(host string) (GatewayLayer, error) {
 	}
 
 	creds := serverConfig.GetCredential()
-	if !creds.IsValid() && !globalIsEnvCreds {
-		return nil, errors.New("Azure backend account and secret keys should be set through ENVs")
-	}
-
 	c, err := storage.NewClient(creds.AccessKey, creds.SecretKey, endpoint, globalAzureAPIVersion, secure)
 	if err != nil {
 		return &azureObjects{}, err
diff --git a/cmd/gateway-main.go b/cmd/gateway-main.go
index a9888bb09..b042dc56b 100644
--- a/cmd/gateway-main.go
+++ b/cmd/gateway-main.go
@@ -290,6 +290,11 @@ func gatewayMain(ctx *cli.Context, backendType gatewayBackend) {
 	// Handle common env vars.
 	handleCommonEnvVars()
 
+	// Validate if we have access, secret set through environment.
+	if !globalIsEnvCreds {
+		fatalIf(fmt.Errorf("Access and Secret keys should be set through ENVs for backend [%s]", backendType), "")
+	}
+
 	// Create certs path.
 	fatalIf(createConfigDir(), "Unable to create configuration directories.")
 
diff --git a/cmd/gateway-s3.go b/cmd/gateway-s3.go
index 98bf96e08..2202d476f 100644
--- a/cmd/gateway-s3.go
+++ b/cmd/gateway-s3.go
@@ -17,7 +17,6 @@
 package cmd
 
 import (
-	"errors"
 	"io"
 	"net/http"
 	"path"
@@ -120,9 +119,6 @@ func newS3Gateway(host string) (GatewayLayer, error) {
 	}
 
 	creds := serverConfig.GetCredential()
-	if !creds.IsValid() && !globalIsEnvCreds {
-		return nil, errors.New("S3 backend account and secret keys should be set through ENVs")
-	}
 
 	// Initialize minio client object.
 	client, err := minio.NewCore(endpoint, creds.AccessKey, creds.SecretKey, secure)
diff --git a/cmd/web-handlers.go b/cmd/web-handlers.go
index 28c84d289..8c41b283c 100644
--- a/cmd/web-handlers.go
+++ b/cmd/web-handlers.go
@@ -690,13 +690,15 @@ func getBucketAccessPolicy(objAPI ObjectLayer, bucketName string) (policy.Bucket
 		policyInfo, err = layer.GetBucketPolicies(bucketName)
 	case *azureObjects:
 		policyInfo, err = layer.GetBucketPolicies(bucketName)
+	case *gcsGateway:
+		policyInfo, err = layer.GetBucketPolicies(bucketName)
 	default:
 		policyInfo, err = readBucketAccessPolicy(objAPI, bucketName)
 	}
 	return policyInfo, err
 }
 
-// GetBucketPolicy - get bucket policy.
+// GetBucketPolicy - get bucket policy for the requested prefix.
 func (web *webAPIHandlers) GetBucketPolicy(r *http.Request, args *GetBucketPolicyArgs, reply *GetBucketPolicyRep) error {
 	objectAPI := web.ObjectAPI()
 	if objectAPI == nil {
@@ -707,9 +709,12 @@ func (web *webAPIHandlers) GetBucketPolicy(r *http.Request, args *GetBucketPolic
 		return toJSONError(errAuthentication)
 	}
 
-	policyInfo, err := readBucketAccessPolicy(objectAPI, args.BucketName)
+	var policyInfo, err = getBucketAccessPolicy(objectAPI, args.BucketName)
 	if err != nil {
-		return toJSONError(err, args.BucketName)
+		_, ok := errorCause(err).(PolicyNotFound)
+		if !ok {
+			return toJSONError(err, args.BucketName)
+		}
 	}
 
 	reply.UIVersion = browser.UIVersion
@@ -745,8 +750,8 @@ func (web *webAPIHandlers) ListAllBucketPolicies(r *http.Request, args *ListAllB
 	if !isHTTPRequestValid(r) {
 		return toJSONError(errAuthentication)
 	}
-	var policyInfo, err = getBucketAccessPolicy(objectAPI, args.BucketName)
 
+	var policyInfo, err = getBucketAccessPolicy(objectAPI, args.BucketName)
 	if err != nil {
 		_, ok := errorCause(err).(PolicyNotFound)
 		if !ok {
@@ -791,7 +796,6 @@ func (web *webAPIHandlers) SetBucketPolicy(r *http.Request, args *SetBucketPolic
 	}
 
 	var policyInfo, err = getBucketAccessPolicy(objectAPI, args.BucketName)
-
 	if err != nil {
 		if _, ok := errorCause(err).(PolicyNotFound); !ok {
 			return toJSONError(err, args.BucketName)