> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reducto.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Hybrid VPC — Google Cloud Storage

> Set up Hybrid VPC with Google Cloud Storage for data sovereignty

Hybrid VPC with Google Cloud Storage uses a service account that you provide to allow Reducto's compute infrastructure to read and write documents in your GCS bucket.

Use Studio to configure GCS environments alongside existing AWS S3 environments. This lets you run migrations with names such as `staging`, `prod`, `staging-gcp`, and `prod-gcp` under the same Reducto organization.

## Setup

1. In Studio, go to **Settings** → **Hybrid VPC**.
2. Add a new environment and choose **Google Cloud Storage** as the provider.
3. Enter the GCP region, bucket name, project ID, and optional bucket folder.
4. Create a service account with access to the bucket and grant it both of these roles on the bucket:
   * `roles/storage.objectAdmin`: read, write, and delete objects
   * `roles/storage.legacyBucketReader`: read bucket metadata
5. Generate a JSON key for that service account and paste it into `service_account_json`.
6. Click **Verify storage access**. Reducto writes and deletes a small verification object.
7. Save the configuration after verification succeeds.

| Value                  | Description                                                                                                                                     |
| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| `storage_type`         | Use `gcs` for Google Cloud Storage environments                                                                                                 |
| `region`               | GCP region, for example `us-central1` or `europe-west1`                                                                                         |
| `bucket`               | GCS bucket name                                                                                                                                 |
| `project_id`           | GCP project ID that owns the bucket                                                                                                             |
| `bucket_folder`        | Optional key prefix for all objects                                                                                                             |
| `service_account_json` | Required. Service account credentials JSON for an account with `roles/storage.objectAdmin` and `roles/storage.legacyBucketReader` on the bucket |

## Security

* **Scoped IAM**: The service account is granted `roles/storage.objectAdmin` and `roles/storage.legacyBucketReader` on the specific bucket only
* **Customer-provided credentials**: You supply the service account JSON in `service_account_json`; scope its IAM to the single bucket and rotate the key on your own schedule
* **Lifecycle management**: Configure object lifecycle rules on the bucket for automatic cleanup