Cloud Storage: Buckets, Objects & Access Control

Google Cloud Storage is a globally unified object storage service for structured and unstructured data. Objects are stored in buckets. There is no directory hierarchy — object names can contain slashes to simulate folders.

Storage Classes

Standard    — frequent access, lowest latency. No minimum duration.
Nearline    — once/month access. 30-day minimum. ~50% cheaper than Standard.
Coldline    — once/quarter access. 90-day minimum. ~75% cheaper.
Archive     — once/year access. 365-day minimum. ~94% cheaper.

Regional vs Multi-regional vs Dual-region:
  Regional        — single region (us-central1). Lower latency within region.
  Multi-region    — spans a continent (US, EU, ASIA). Higher availability.
  Dual-region     — two specific regions. 99.95% SLA, turbo replication option.

Choose class at bucket level or per-object. Lifecycle rules can auto-transition objects.

Creating Buckets & Uploading

# Create bucket
gcloud storage buckets create gs://my-bucket   --location=us-central1   --storage-class=STANDARD

# Create bucket with uniform bucket-level access
gcloud storage buckets create gs://my-bucket   --location=us-central1   --uniform-bucket-level-access

# Upload files
gcloud storage cp local-file.txt gs://my-bucket/
gcloud storage cp -r ./local-dir/ gs://my-bucket/prefix/  # recursive

# Download
gcloud storage cp gs://my-bucket/file.txt ./local/
gcloud storage cp -r gs://my-bucket/prefix/ ./local/

# List objects
gcloud storage ls gs://my-bucket/
gcloud storage ls -l gs://my-bucket/   # with size/date
gcloud storage ls -r gs://my-bucket/  # recursive

# Delete
gcloud storage rm gs://my-bucket/file.txt
gcloud storage rm -r gs://my-bucket/prefix/  # recursive
gcloud storage rm --all-versions gs://my-bucket/file.txt

Access Control

Cloud Storage supports two access control models: fine-grained (legacy ACLs per object) and uniform bucket-level access (IAM-only, recommended).

# Uniform bucket-level access (recommended — IAM controls everything)
gcloud storage buckets update gs://my-bucket   --uniform-bucket-level-access

# Grant IAM roles on bucket
gcloud storage buckets add-iam-policy-binding gs://my-bucket   --member="user:alice@example.com"   --role="roles/storage.objectViewer"

gcloud storage buckets add-iam-policy-binding gs://my-bucket   --member="serviceAccount:my-sa@project.iam.gserviceaccount.com"   --role="roles/storage.objectAdmin"

# Common Storage IAM roles:
# roles/storage.objectViewer     — read objects
# roles/storage.objectCreator    — create/overwrite objects
# roles/storage.objectAdmin      — full object control
# roles/storage.admin            — full bucket + object control

# Make bucket public (all users can read)
gcloud storage buckets add-iam-policy-binding gs://my-bucket   --member="allUsers"   --role="roles/storage.objectViewer"

# Check effective IAM policy
gcloud storage buckets get-iam-policy gs://my-bucket

Python Client Library

from google.cloud import storage

client = storage.Client()

# Create bucket
bucket = client.create_bucket("my-bucket", location="us-central1")

# Upload from file
bucket = client.bucket("my-bucket")
blob = bucket.blob("path/to/object.txt")
blob.upload_from_filename("local-file.txt")
blob.upload_from_string("Hello, World!", content_type="text/plain")

# Download
blob.download_to_filename("local-copy.txt")
content = blob.download_as_text()

# List objects
blobs = client.list_blobs("my-bucket", prefix="images/")
for blob in blobs:
    print(blob.name, blob.size)

# Delete
blob.delete()

# Copy between buckets
source = client.bucket("source-bucket").blob("file.txt")
dest = client.bucket("dest-bucket")
source_bucket = client.bucket("source-bucket")
source_bucket.copy_blob(source, dest, "new-name.txt")