Skip to main content

Connect Google Cloud Storage with VectorAmp's service account

Use this setup when VectorAmp asks you to grant a Google Cloud Storage bucket to a VectorAmp service account.

VectorAmp service account:

gdrive-ingestion@vectoramp-customer-ingestion.iam.gserviceaccount.com

What you need​

  • A Google Cloud project that owns the bucket.
  • The bucket name.
  • Optional: a prefix such as docs/ if VectorAmp should ingest only part of the bucket.
  • Permission to edit bucket IAM, or help from a Google Cloud administrator.

Grant bucket read access​

  1. Open the Google Cloud Storage Buckets page.

  2. Select the Google Cloud project that contains your bucket.

  3. Click the bucket you want VectorAmp to ingest.

  4. Open the Permissions tab.

  5. Click Grant access.

  6. In New principals, paste:

    gdrive-ingestion@vectoramp-customer-ingestion.iam.gserviceaccount.com

  7. In Assign roles, select Cloud Storage → Storage Object Viewer.

  8. Click Save.

This allows VectorAmp to list and read objects in the bucket. It does not allow VectorAmp to write, edit, or delete objects.

Copy the bucket name​

  1. Open the Cloud Storage Buckets page.
  2. Find your bucket in the table.
  3. Copy the value in the Name column.
  4. Paste that value into VectorAmp's Bucket field.

Example bucket name:

customer-documents-prod

Do not include gs:// in the bucket field.

Limit ingestion to a prefix​

Use a prefix when VectorAmp should ingest only a folder-like path inside the bucket.

  1. Open your bucket in the Cloud Storage browser.
  2. Open the folder/prefix you want to ingest.
  3. Copy the path shown inside the bucket.
  4. Paste that path into VectorAmp's Prefix field.

Example:

docs/contracts/

Leave Prefix empty to ingest the whole bucket.

If your organization requires prefix-level access​

Google Cloud Storage IAM is usually granted at the bucket level. If your organization requires narrower access, use IAM Conditions:

  1. Open the bucket's Permissions tab.
  2. Click Grant access.
  3. Add the VectorAmp service account as the principal.
  4. Select Storage Object Viewer.
  5. Click Add IAM condition.
  6. Name the condition, for example VectorAmp docs prefix.
  7. Use a condition that limits object names to your prefix.
  8. Save the condition and grant.

If you are unsure how to write the condition, ask your Google Cloud administrator. The simplest supported setup is bucket-level Storage Object Viewer plus a VectorAmp prefix filter.

Troubleshooting​

VectorAmp cannot list objects​

Check that:

  • The service account has Storage Object Viewer on the bucket.
  • The bucket name is entered without gs://.
  • The prefix, if set, exactly matches the object path prefix.
  • Your Google Cloud project policy allows granting access to external service accounts.

I cannot grant access​

You need permission to edit bucket IAM, such as Storage Admin or Project IAM Admin. Ask your Google Cloud administrator to grant the VectorAmp service account Storage Object Viewer.

Fallback: use your own service account JSON​

Use this only if your Google Cloud policy blocks granting bucket access to VectorAmp's service account.

Create a service account​

  1. Open the Google Cloud Console service accounts page.
  2. Select the Google Cloud project that owns your bucket.
  3. Click Create service account.
  4. Enter a service account name, for example vectoramp-gcs-ingestion.
  5. Click Create and continue.
  6. In Grant this service account access to project, you can skip project-wide roles if you plan to grant access directly on the bucket.
  7. Click Continue.
  8. Click Done.

Grant the service account bucket read access​

  1. Open the Cloud Storage Buckets page.
  2. Click the bucket you want VectorAmp to ingest.
  3. Open the Permissions tab.
  4. Click Grant access.
  5. In New principals, paste the service account email you just created.
  6. In Assign roles, select Cloud Storage → Storage Object Viewer.
  7. Click Save.

Create a JSON key​

  1. Return to the Service accounts page.
  2. Click your service account.
  3. Open the Keys tab.
  4. Click Add key.
  5. Click Create new key.
  6. Select JSON.
  7. Click Create.
  8. Google downloads a .json file to your computer.

Treat this file like a password. Anyone with the file can read objects allowed by that service account.

Add it in VectorAmp​

  1. In VectorAmp, choose Upload my own service account JSON.
  2. Drag/select the downloaded .json key file, or paste the full JSON contents.
  3. Enter the bucket name.
  4. Optionally enter a prefix, such as docs/contracts/.
  5. Save the source.