Skip to main content
Hybrid VPC with Google Cloud Storage uses a service account that you provide to allow Reducto’s compute infrastructure to read and write documents in your GCS bucket. Use Studio to configure GCS environments alongside existing AWS S3 environments. This lets you run migrations with names such as staging, prod, staging-gcp, and prod-gcp under the same Reducto organization.

​
Setup

  1. In Studio, go to Settings → Hybrid VPC.
  2. Add a new environment and choose Google Cloud Storage as the provider.
  3. Enter the GCP region, bucket name, project ID, and optional bucket folder.
  4. Create a service account with access to the bucket and grant it both of these roles on the bucket:
    • roles/storage.objectAdmin: read, write, and delete objects
    • roles/storage.legacyBucketReader: read bucket metadata
  5. Generate a JSON key for that service account and paste it into service_account_json.
  6. Click Verify storage access. Reducto writes and deletes a small verification object.
  7. Save the configuration after verification succeeds.
ValueDescription
storage_typeUse gcs for Google Cloud Storage environments
regionGCP region, for example us-central1 or europe-west1
bucketGCS bucket name
project_idGCP project ID that owns the bucket
bucket_folderOptional key prefix for all objects
service_account_jsonRequired. Service account credentials JSON for an account with roles/storage.objectAdmin and roles/storage.legacyBucketReader on the bucket

​
Security

  • Scoped IAM: The service account is granted roles/storage.objectAdmin and roles/storage.legacyBucketReader on the specific bucket only
  • Customer-provided credentials: You supply the service account JSON in service_account_json; scope its IAM to the single bucket and rotate the key on your own schedule
  • Lifecycle management: Configure object lifecycle rules on the bucket for automatic cleanup