Google Cloud Storage
Read and write objects in a Google Cloud Storage bucket, signing in with a service account key or the server's own Workload Identity.
Settings
What the connection form asks for. Every connection has a Staging side, which it needs, and an optional Production side with values of its own; both ask for the same settings.
| Bucket | |
| Endpoint (optional) | Set only for a private endpoint or a local emulator. Blank uses Google's public API. |
| Service Account JSON | Paste the whole key file (IAM & Admin → Service Accounts → Keys → Add key → JSON), and grant that account Storage Object Admin on the bucket. Leave blank to use the server's Workload Identity / Application Default Credentials (recommended when Trinium runs on GKE / GCE / Cloud Run). HMAC interoperability keys are not used here: they are S3-style credentials, so use the Amazon S3 connector with the endpoint https://storage.googleapis.com instead. Stored encrypted, and never shown again after you save it. |
Testing the connection
Test lists the bucket. A service account that may read files but not list them still passes: Google checks the key before the permissions, and that is an ordinary least-privilege grant.
Good to know
- Leaving the key blank uses the server's Workload Identity or Application Default Credentials, on a shared connection an administrator manages only.
- HMAC interoperability keys belong to the S3 connector, with the endpoint
https://storage.googleapis.com.
Nodes that use it
Copy, move or delete the files an input, List Files or File from URL hands it through its Files anchor, before the data is processed or after the run succeeds or fails.
Write the pipeline's output to a Google Cloud Storage bucket with a templated key (dates, run id) and a write mode.
Read a single object or a whole prefix from a Google Cloud Storage bucket. A Bookmark can read only the files no successful run has read.
List the files in a folder as rows, with each one's path, name, size and modified time, without reading any of them.