Prepare for online transfer

Online transfer requires setup for the first time you use it. Subsequent transfers after initial setup don't require these steps.

Enable the APIs

To complete first-time setup for online transfer, a Google Cloud administrator must do the following:

1. Enable the Google Storage Transfer API.

   Roles required to enable APIs

   To enable APIs, you need the Service Usage Admin IAM role ( roles/serviceusage.serviceUsageAdmin ), which contains the serviceusage.services.enable permission. Learn how to grant roles .

   Enable the API

   1. Confirm the project you are enabling the API for, then click Next.

   2. Click Enable.

2. Enable the Pub/Sub API.

   Roles required to enable APIs

   To enable APIs, you need the Service Usage Admin IAM role ( roles/serviceusage.serviceUsageAdmin ), which contains the serviceusage.services.enable permission. Learn how to grant roles .

   Enable the API

   1. Confirm the project you are enabling the API for, then click Next.

   2. Click Enable.

Configure the Storage Transfer Service service agent

In the email titled Google Transfer Appliance Prepare Destination Bucket , a service agent is specified for you. It looks similar to the following example:

project- IDENTIFIER 
@storage-transfer-service.gserviceaccount.com

Grant the following role to the Storage Transfer Service service agent on your project :

• Pub/Sub Editor

Grant the following role to the Storage Transfer Service service agent for the destination bucket :

• Storage Admin

Create and configure a user-managed service account

1. Create a user-managed service account in your project.

2. Grant the following roles to the user-managed service account on your project :

   • Pub/Sub Editor
   • Storage Transfer Admin
   • Monitoring Metric Writer if you'll enable Cloud Monitoring .

3. Grant the following role to the user-managed service account for the destination bucket :

   • Storage Admin

Once the service account is configured, prepare a service account key:

1. Create a service account key for the user-managed service account. The key is downloaded when you create it, and you cannot download it again.

2. Rename the key to key.json , and save it to a safe location.

3. Once you've received your appliance, upload key.json to the /tmp directory on the appliance.