Bring your own bucketSFTP to Google Cloud Storage, through the XML API
Google Cloud Storage has no SFTP endpoint, but its XML API speaks the S3 protocol with HMAC keys. CloudFile uses it to write partner uploads straight into your GCS bucket, with a service account that only has access to that bucket.
Google Cloud Storage with CloudFile, at a glance.
| Endpoint | https://storage.googleapis.com (the XML API), region auto |
|---|---|
| URL style | Path-style |
| Credentials | An HMAC key for a service account with the Storage Object User role on one bucket. Not a JSON key file. |
| Locations | Any Cloud Storage location, e.g. europe-west3 (Frankfurt). Google accepts any region value when signing. |
| Pricing model | Storage per GB-month by location and class, operations per request, and egress per GB. Soft delete is on by default for 7 days and billed. |
Google Cloud Storage prices are from their public website as of October 2026, excluding taxes. Your bucket is billed by Google Cloud Storage, not by us, and doesn't count toward your plan's storage.
Why pair SFTP with Google Cloud Storage.
Stay inside Google Cloud
Files land in a bucket governed by your IAM, organization policies and audit logs, next to BigQuery, Dataflow and Cloud Run.
Trigger Google Cloud services
New objects are ordinary GCS objects, so storage triggers for Cloud Run functions still fire. CloudFile's signed webhooks are an alternative.
One bucket, one role
Grant Storage Object User on the bucket only. The service account has no project-wide roles.
No SFTP VM on Compute Engine
Skip the VM with gcsfuse and an SSH daemon. CloudFile runs the server and keeps it patched.
How it works, in three steps.
- Step 1
Create a bucket, service account and HMAC key
Create a Standard bucket with uniform access. Grant a new service account Storage Object User on it, then create an HMAC key under Settings → Interoperability.
[email protected] roles/storage.objectUser HMAC ✓ - Step 2
Connect it in CloudFile
Storage → Add bucket → Google Cloud Storage. Paste the HMAC access key and secret; the endpoint and region are preset.
https://storage.googleapis.com auto ✓ test passed - Step 3
Uploads go to GCS
Each user writes under its own prefix. A webhook or a Cloud Storage trigger starts your pipeline.
acme → gs://acme-sftp/acme/exports/q3.csv
Every click and field is in the Google Cloud Storage setup guide.
What your partners see, and where it lands in Google Cloud Storage.
$ sftp -P 22000 [email protected]
sftp> put invoice-2026-10.pdf
sftp> ls
invoice-2026-10.pdfYour Google Cloud Storage bucket<bucket>/<folder>/acme/invoice-2026-10.pdf
<bucket>/<folder>/_shared/inbox/…Any SFTP, FTPS or FTP client: FileZilla, WinSCP, Cyberduck, the sftp command or their own system. WebDAV too, if you turn it on.
Their own home folder as /, and nothing else. They never see the bucket name, other users' folders or your keys.
A password, an SSH key or both, with the permissions you pick: full access, read only or upload only.
Shared folders at /shared/<name> when several users need the same files. They live under _shared/<name>/ in your Google Cloud Storage bucket.
Get these right in Google Cloud Storage.
Soft delete keeps deleted files for 7 days by default, and they're billed. Consider turning it off (retention 0) for a busy drop folder.
Use the Standard storage class. Nearline, Coldline and Archive have minimum storage durations and retrieval fees.
Organization policies such as constraints/storage.restrictAuthTypes or iam.disableServiceAccountKeyCreation can block HMAC keys. Ask an admin to allow them for the project.
Questions about SFTP on Google Cloud Storage.
Does CloudFile support Google Cloud Storage natively?
It uses Cloud Storage's S3-compatible XML API with HMAC keys, which Google documents for exactly this kind of tool. You don't need a JSON key file.
Service account or user account HMAC key?
A service account key. Google recommends service accounts for production, and access doesn't break when a person leaves. You can have up to 10 HMAC keys per service account.
I shared the bucket but the test says Access denied.
Buckets with uniform bucket-level access ignore ACLs. Grant the IAM role Storage Object User on the bucket's Permissions tab. Changes can take a minute.
Can I trigger a Cloud Run function on upload?
Yes. Use a Cloud Storage trigger on the bucket as you normally would, or add a CloudFile listener that POSTs to the function with a signed payload and a download link.
More in the docs: Google Cloud Storage setup · Your own bucket · Webhooks
