Skip to main content
Hybrid VPC with Google Cloud Storage uses a service account that you provide to allow Reducto’s compute infrastructure to read and write documents in your GCS bucket. Use Studio to configure GCS environments alongside existing AWS S3 environments. This lets you run migrations with names such as staging, prod, staging-gcp, and prod-gcp under the same Reducto organization.

​
Setup

  1. In Studio, go to Settings → Hybrid VPC.
  2. Add a new environment and choose Google Cloud Storage as the provider.
  3. Enter the GCP region, bucket name, project ID, and optional bucket folder.
  4. Create a service account with access to the bucket and grant it both of these roles on the bucket:
    • roles/storage.objectAdmin: read, write, and delete objects
    • roles/storage.legacyBucketReader: read bucket metadata
  5. Generate a JSON key for that service account and paste it into service_account_json.
  6. Click Verify storage access. Reducto writes and deletes a small verification object.
  7. Save the configuration after verification succeeds.

​
Security

  • Scoped IAM: The service account is granted roles/storage.objectAdmin and roles/storage.legacyBucketReader on the specific bucket only
  • Customer-provided credentials: You supply the service account JSON in service_account_json; scope its IAM to the single bucket and rotate the key on your own schedule
  • Lifecycle management: Configure object lifecycle rules on the bucket for automatic cleanup