Storage / Google Cloud StorageMenu

Google Cloud StorageGoogle Cloud Storage

Store your SFTP server's files in your own Google Cloud Storage bucket, using the XML API and an HMAC key.

Google Cloud Storage speaks the S3 protocol through its XML API at storage.googleapis.com. You sign requests with an HMAC key that belongs to a service account.

Before you start

  • A Google Cloud project with billing enabled.
  • Permission to create buckets, service accounts and HMAC keys. If your organization enforces the constraints/storage.restrictAuthTypes or constraints/iam.disableServiceAccountKeyCreation policies, ask an admin to allow HMAC keys for this project.

1. Create the bucket

  1. In the Google Cloud console, go to Cloud Storage → Buckets and choose Create.
  2. Name the bucket and pick a location, for example the europe-west3 region (Frankfurt).
  3. Keep the Standard storage class. Other classes have minimum storage durations and retrieval fees.
  4. Keep public access prevention on and choose Uniform access control.
  5. Under data protection, consider turning the soft delete policy off. It’s on by default with a 7-day retention, and soft-deleted files keep accruing storage charges. Leave object versioning and retention policies off: they keep deleted files around or block deletes.
  6. Choose Create.

2. Create an access key

Create a service account, give it access to this one bucket, and create an HMAC key for it.

  1. Go to IAM & Admin → Service Accounts and create a service account, for example cloudfile. Don’t grant it any project-wide roles.
  2. Open your bucket, go to the Permissions tab and choose Grant access.
  3. Enter the service account’s email as the principal and give it the Storage Object User role (roles/storage.objectUser). It covers listing, reading, writing and deleting objects, and aborting multipart uploads, but only in this bucket.
  4. Go to Cloud Storage → Settings, open the Interoperability tab and choose Create a key for a service account.
  5. Pick the cloudfile service account and choose Create key.
  6. Copy the Access key and Secret. Google shows the secret only once.

Use a service account HMAC key, not a service account JSON key file and not a user account HMAC key.

3. Connect it

In CloudFile, go to Storage → Add bucket and choose Google Cloud Storage:

Field Value
Bucket Your bucket name
Region auto
Endpoint https://storage.googleapis.com
Access key ID The HMAC access key
Secret access key The HMAC secret
Name Optional, e.g. Production
Path-style URLs On

Google accepts any region value when signing, so auto works for buckets in every location.

Click Test connection, then Save. To use the bucket, open a server and pick it under Settings → Storage.

Troubleshooting

  • Writing a test file failed with an invalid access key or signature error. The key was deactivated or deleted, or the secret was copied incompletely. Check the key’s state on the Interoperability tab.
  • Writing a test file failed: Access denied. The service account has no role on this bucket. Grant Storage Object User on the bucket’s Permissions tab. Role changes can take a minute to apply.
  • Writing a test file failed: Access denied, although you shared the bucket. You granted access with an ACL rather than an IAM role. Buckets with uniform bucket-level access ignore ACLs: grant the IAM role on the Permissions tab instead.
  • Deleting the test file failed. The bucket has a retention policy or object holds.

See Your own bucket for how files are laid out in the bucket.