Google cloud storage

​

Step 1: create a service account

1

Open the Service Accounts menu

In the GCP console, in the same project as your bucket, navigate to the IAM & Admin menu, open the Service Accounts tab, and click Create service account.

2

Name the service account

Give the service account a descriptive name and click Create and Continue. Click Continue and Done through the remaining optional steps without assigning any roles.

3

Note the email

Open the service account in the list and make a note of its email, which looks like service-account-name@project-id.iam.gserviceaccount.com. You will provide this email in Step 5.

​

Step 2: grant read access to the bucket

​

Step 3: authorize authentication

• Service account impersonation (recommended)
• HMAC keys
• Service account key

1

Open the service account permissions

In the IAM & Admin menu, open the Service Accounts tab and click the service account you created in Step 1 to open its details. Navigate to the Principals with access tab and click Grant Access.

2

Grant permission to impersonate

Add our service account as a principal and grant it both the Service Account Token Creator and Service Account User roles. Reach out to your account representative for the exact service account email to add.

An HMAC key is a credential associated with a service account that can be used to access Google Cloud Storage.

1

Open the Interoperability settings

Navigate to the Cloud Storage page, click into the Settings tab, and navigate to the Interoperability tab. Click Create a key for a Service Account.

2

Create the key

Select the service account you created in Step 1 and click Create key.

3

Note the access key and secret

Make a note of the Access key and the Secret. You will provide these values in Step 5.

A service account key is a long-lived credential. Use this method only when your policy prevents impersonation, and store the key securely.

1

Open the key menu

In the Service accounts list, click the Actions menu next to the service account from Step 1 and click Manage keys.

2

Create a new key

Click Add key, then Create new key.

3

Download the JSON key

Select the JSON key type and click Create. Store the downloaded key securely, as you will provide its contents in Step 5.

​

Step 4: find your bucket region

​

Step 5: submit your connection details

1. The name is a descriptive name of the source.
2. The bucket name of the bucket you want to read from.
3. The region (the bucket location) from Step 4.
4. The authentication credentials from Step 3:
   • If using impersonation: the service account email from Step 1.
   • If using HMAC keys: the access key and the secret.
   • If using a service account key: the service account email from Step 1 and the JSON key you downloaded.