| name | cloud-storage |
| description | Manage object storage on Google Cloud Storage. Covers bucket creation, IAM, uniform access control, lifecycle policies, signed URLs, and gsutil/gcloud CLI patterns. Enforces private-by-default: never creates public buckets without explicit intent and gcp-security sign-off. |
| version | 0.1 |
| triggers | ["cloud storage","GCS","bucket","gsutil","object storage","upload to GCP","storage IAM","signed URL","lifecycle policy","storage class"] |
| required_scopes | ["storage.buckets.create","storage.buckets.get","storage.buckets.getIamPolicy","storage.buckets.setIamPolicy","storage.objects.create","storage.objects.get","storage.objects.list"] |
| mcp_servers | ["google-storage"] |
Cloud Storage
Highly durable, globally consistent object storage. Private by default — always review IAM before making anything public.
Safety Rule — Never Public by Default
New buckets must use uniform bucket-level access and must not grant allUsers or allAuthenticatedUsers without explicit design intent and gcp-security sign-off.
Core Patterns
Create a bucket (private, uniform access)
gcloud storage buckets create gs://BUCKET_NAME \
--location=REGION \
--uniform-bucket-level-access \
--project=PROJECT_ID
Grant access (least-privilege)
gcloud storage buckets add-iam-policy-binding gs://BUCKET_NAME \
--member="serviceAccount:SA@PROJECT.iam.gserviceaccount.com" \
--role="roles/storage.objectViewer"
Upload / download
gcloud storage cp LOCAL_FILE gs://BUCKET_NAME/path/
gcloud storage cp gs://BUCKET_NAME/path/FILE ./local/
Lifecycle policy (auto-delete after N days)
cat > /tmp/lifecycle.json <<'EOF'
{
"rule": [{
"action": {"type": "Delete"},
"condition": {"age": 90}
}]
}
EOF
gcloud storage buckets update gs://BUCKET_NAME \
--lifecycle-file=/tmp/lifecycle.json
Generate a signed URL (time-limited access)
gcloud storage sign-url gs://BUCKET_NAME/OBJECT \
--duration=1h \
--private-key-file=KEY_FILE
References
