This page describes how to configure your bucket to send notifications about object changes to a Pub/Sub topic. For information on subscribing to a Pub/Sub topic that receives notifications, see Choose a subscription type .
Before you begin
Before using this feature, complete the following instructions.
Enable the Pub/Sub API
Enable the Pub/Sub API for the project that will receive notifications.
Make sure you have an existing Pub/Sub topic
If you haven't already, create a Pub/Sub topic to which you want to send notifications. This step is not necessary if you plan on using the Google Cloud CLI or Terraform to perform the instructions on this page.
Get required roles
IAM role requirements differ depending on whether you're configuring the notificationor delivering the event data:
-
If you use the Google Cloud CLI or Terraform to configure a notification, your identity only needs permissions to update bucket metadata and view the Pub/Sub topic. To get all the permissions required, follow the instructions in Get roles for viewing bucket metadata and the Pub/Sub topic .
-
If your Cloud Storage service agent is delivering notifications, it must have the Pub/Sub Publisher role (
roles/pubsub.publisher) on the Pub/Sub topic. Once this role is configured for the service agent, the service agent acts as a background "worker" to push events to your topic.To grant your service agent the permissions required to push event notifications to your topic, follow the instructions in Grant roles to your project's service agent .
Get roles for viewing bucket metadata and the Pub/Sub topic
To get the permissions that you need to configure and view Pub/Sub notifications for a bucket, ask your administrator to grant you the following roles. These predefined roles contain the permissions required to configure and view Pub/Sub notifications.
-
Storage Admin (
roles/storage.admin) role on the bucket for which you want to configure Pub/Sub notifications -
Pub/Sub Admin (
roles/pubsub.admin) role on the project in which you want to receive Pub/Sub notifications
You might be able to get these permissions with other predefined roles or custom roles .
See Set and manage IAM policies on buckets for instructions on granting roles on buckets. See Controlling access for instructions on granting roles on projects and setting access controls for topics and subscriptions.
Grant required role to your project's service agent
This section shows you how to grant the permissions required for your service agent to deliver notifications.
-
Get the email address of the service agent associated with the project that contains your Cloud Storage bucket. The service agent email address follows the format:
service- PROJECT_NUMBER @gs-project-accounts.iam.gserviceaccount.com -
Grant the service agent the Pub/Sub Publisher (
roles/pubsub.publisher) role for the relevant Pub/Sub topic. See Controlling access for instructions on granting roles for topics.
Apply a notification configuration
The following steps add a notification configuration to your bucket that sends notifications for all supported events .
Console
You cannot manage Pub/Sub notifications with the Google Cloud console. Use the gcloud CLI or one of the available client libraries instead.
Command line
Use the gcloud storage buckets notifications create
command
:
gcloud storage buckets notifications create gs:// BUCKET_NAME --topic= TOPIC_NAME
Where:
-
BUCKET_NAMEis the name of the relevant bucket. For example,my-bucket. -
TOPIC_NAMEis the Pub/Sub topic to send notifications to. If you specify a topic that doesn't exist in your project, the command creates one for you.
To send notifications for a subset of events, include the --event-types
flag
.
Client libraries
C++
For more information, see the Cloud Storage C++ API reference documentation .
To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .
C#
For more information, see the Cloud Storage C# API reference documentation .
To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .
Go
For more information, see the Cloud Storage Go API reference documentation .
To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .
Java
For more information, see the Cloud Storage Java API reference documentation .
To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .
Node.js
For more information, see the Cloud Storage Node.js API reference documentation .
To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .
PHP
For more information, see the Cloud Storage PHP API reference documentation .
To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .
To create a notification configuration for a bucket using PHP, see the Google Cloud Client Library reference documentation.Python
For more information, see the Cloud Storage Python API reference documentation .
To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .
Ruby
For more information, see the Cloud Storage Ruby API reference documentation .
To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries .

