GCP for DevOps — Cloud Storage Basics

Cloud Storage Basics

Cloud Storage is GCP’s object storage service. Objects (files) are stored in buckets. Bucket names are globally unique, and objects are accessed via gs://bucket-name/object-path.

Storage Classes

Class	Min Duration	Use Case	Price (per GB/month)
Standard	None	Frequently accessed data	~$0.020
Nearline	30 days	Accessed < 1x/month	~$0.010
Coldline	90 days	Accessed < 1x/quarter	~$0.004
Archive	365 days	Accessed < 1x/year	~$0.0012

Early deletion charges apply if objects are deleted before the minimum duration.

Creating Buckets

# Create a Standard bucket
$ gcloud storage buckets create gs://my-devops-artifacts \
    --location=us-central1 \
    --default-storage-class=STANDARD \
    --uniform-bucket-level-access

Creating gs://my-devops-artifacts/...

# Create a multi-region bucket for DR
$ gcloud storage buckets create gs://my-backup-bucket \
    --location=us \
    --default-storage-class=NEARLINE \
    --uniform-bucket-level-access

# List buckets
$ gcloud storage buckets list --format="table(name,location,default_storage_class)"

NAME                     LOCATION     DEFAULT_STORAGE_CLASS
my-devops-artifacts      us-central1  STANDARD
my-backup-bucket         us           NEARLINE

Working with Objects

# Upload a file
$ gcloud storage cp build-output.tar.gz gs://my-devops-artifacts/builds/

Copying file://build-output.tar.gz to gs://my-devops-artifacts/builds/build-output.tar.gz

# Upload a directory recursively
$ gcloud storage cp -r ./dist/ gs://my-devops-artifacts/releases/v2.0/

# Download a file
$ gcloud storage cp gs://my-devops-artifacts/builds/build-output.tar.gz ./

# List objects
$ gcloud storage ls gs://my-devops-artifacts/builds/

gs://my-devops-artifacts/builds/build-output.tar.gz

# List with details
$ gcloud storage ls -l gs://my-devops-artifacts/builds/

  1234567  2026-03-30T12:00:00Z  gs://my-devops-artifacts/builds/build-output.tar.gz

# Delete an object
$ gcloud storage rm gs://my-devops-artifacts/builds/build-output.tar.gz

Removing gs://my-devops-artifacts/builds/build-output.tar.gz...

# Sync a directory (like rsync)
$ gcloud storage rsync -r ./dist/ gs://my-devops-artifacts/releases/v2.0/

Access Control

GCP offers two access control models for buckets:

Model	Description	Recommended
Uniform	IAM only — consistent permissions	✅ Yes
Fine-grained	IAM + ACLs per object	Legacy only

# Set uniform bucket-level access (recommended)
$ gcloud storage buckets update gs://my-devops-artifacts \
    --uniform-bucket-level-access

# Grant read access to a service account
$ gcloud storage buckets add-iam-policy-binding gs://my-devops-artifacts \
    --member="serviceAccount:ci@my-project.iam.gserviceaccount.com" \
    --role="roles/storage.objectViewer"

# Grant write access
$ gcloud storage buckets add-iam-policy-binding gs://my-devops-artifacts \
    --member="serviceAccount:ci@my-project.iam.gserviceaccount.com" \
    --role="roles/storage.objectCreator"

# View bucket IAM policy
$ gcloud storage buckets get-iam-policy gs://my-devops-artifacts

Signed URLs (Temporary Access)

Generate a time-limited URL to share an object without granting permanent access.

# Generate a signed URL valid for 1 hour
$ gcloud storage sign-url gs://my-devops-artifacts/builds/app.tar.gz \
    --duration=1h

signed_url: https://storage.googleapis.com/my-devops-artifacts/builds/app.tar.gz?X-Goog-Algorithm=...

Bucket Location Types

Type	Example	Redundancy	Latency
Region	us-central1	Single region	Lowest
Dual-region	us-east1+us-west1	Two specific regions	Low
Multi-region	us, eu, asia	Multiple regions	Variable

Common Mistakes

Mistake	Why It’s Wrong	Fix
Not enabling uniform access	Mixed ACLs are confusing	Always use --uniform-bucket-level-access
Using multi-region for everything	More expensive, higher latency	Use regional for most workloads
Not setting storage class	Defaults to Standard (most expensive)	Choose based on access frequency
Public buckets	Security risk	Use signed URLs or IAM
Not encrypting sensitive data	Data at rest may be exposed	Use CMEK for sensitive buckets

Quick Reference

Command	Description
gcloud storage buckets create gs://NAME	Create bucket
gcloud storage cp FILE gs://BUCKET/	Upload file
gcloud storage cp -r DIR gs://BUCKET/	Upload directory
gcloud storage ls gs://BUCKET/	List objects
gcloud storage rm gs://BUCKET/OBJECT	Delete object
gcloud storage rsync -r SRC DST	Sync directories
gcloud storage buckets add-iam-policy-binding	Grant access

Next → Versioning & Lifecycle