Google Cloud Storage

Connect Google Cloud Storage to collect cloud storage provider evidence automatically.

Step-by-step guide: Connect Google Cloud Storage.

Connect with OAuth

Before you start, an administrator of Google Cloud Storage must allow third-party apps:

• If your organization uses Google Workspace app access control: in the Google Admin console go to Menu › Security › Access and data control › API controls, click Manage App Access, then Configure new app.
• Enter Safeguard's app name or client ID and click Search, select it, choose the organizational units, and set access to Trusted or Specific Google data; click Continue and Finish. Changes can take up to 24 hours.

1. On Compliance › Connectors, open Google Cloud Storage, click Connect and choose OAuth.
2. Sign in to Google Cloud Storage and approve Safeguard on its consent screen. Use an account that can approve apps for your organization, usually an administrator. Safeguard asks for https://www.googleapis.com/auth/devstorage.read_only.
3. You return to Safeguard, and the card shows Verified once the first check succeeds.

Connect with an API token

1. In Google Cloud Storage:

   1. In the Google Cloud console, go to the Service accounts page and select your project.
   2. Click the email address of the service account Safeguard will use.
   3. Click the Keys tab, click the Add key drop-down menu and select Create new key.
   4. Select JSON as the Key type and click Create. The key file downloads; you cannot download it again.
   5. In the Google Cloud console, go to the IAM page and select the project.
   6. Click Grant Access, enter the service account's email as the principal, click Select a role and choose Storage Bucket Viewer (roles/storage.bucketViewer), which views buckets and their metadata, excluding IAM policies. Click Save.

   Google Cloud Storage shows the secret only once, so copy it before you leave the page.

   Source: docs.cloud.google.com, docs.cloud.google.com, docs.cloud.google.com, knowledge.workspace.google.com, checked 2026-10-07.

2. On Compliance › Connectors, open Google Cloud Storage, click Connect, choose API token and fill in:

   Field	What to enter
   Service account key (JSON)	Required. Paste the full service-account JSON key. Needs roles/viewer (cloud-platform.read-only). Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

No automated compliance test reads Google Cloud Storage yet, so no framework lists it. How connectors provide evidence for frameworks: Frameworks and connectors.

Related

• Cloud Storage Provider connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks