Cloud Storage

# Create a bucket (globally unique name)
gcloud storage buckets create gs://my-bucket --location=us-central1

# With storage class
gcloud storage buckets create gs://my-bucket \
  --location=us-central1 \
  --default-storage-class=NEARLINE

# Enable versioning
gcloud storage buckets update gs://my-bucket --versioning

# Set uniform bucket-level access (recommended, disables per-object ACLs)
gcloud storage buckets update gs://my-bucket --uniform-bucket-level-access

# List buckets
gcloud storage buckets list

# Upload file / directory
gcloud storage cp ./file.txt gs://my-bucket/
gcloud storage cp -r ./local-dir gs://my-bucket/remote-dir

# Download
gcloud storage cp gs://my-bucket/file.txt ./file.txt

# List objects
gcloud storage ls gs://my-bucket/
gcloud storage ls -l gs://my-bucket/          # with sizes
gcloud storage ls -r gs://my-bucket/          # recursive

# Move / rename
gcloud storage mv gs://my-bucket/old.txt gs://my-bucket/new.txt

# Delete
gcloud storage rm gs://my-bucket/file.txt
gcloud storage rm -r gs://my-bucket/dir/      # recursive

# Delete bucket + all contents
gcloud storage rm -r gs://my-bucket

# Sync local dir → bucket (upload new/changed only)
gcloud storage rsync ./local-dir gs://my-bucket/remote-dir

# Sync with deletion (mirror exactly)
gcloud storage rsync -d ./local-dir gs://my-bucket/remote-dir

# Sync bucket → local
gcloud storage rsync gs://my-bucket/remote-dir ./local-dir

# Dry run
gcloud storage rsync -n ./local-dir gs://my-bucket/remote-dir

# Make a single object public
gcloud storage objects update gs://my-bucket/file.txt \
  --add-acl-grant=entity=allUsers,role=READER

# Make entire bucket public (allUsers READ)
gcloud storage buckets add-iam-policy-binding gs://my-bucket \
  --member=allUsers --role=roles/storage.objectViewer

# Grant a user access to a bucket
gcloud storage buckets add-iam-policy-binding gs://my-bucket \
  --member=user:alice@example.com \
  --role=roles/storage.objectAdmin

# Grant a service account access
gcloud storage buckets add-iam-policy-binding gs://my-bucket \
  --member=serviceAccount:sa@proj.iam.gserviceaccount.com \
  --role=roles/storage.objectCreator

# Generate a signed URL valid for 1 hour (signs with the key's service account)
gcloud storage sign-url gs://my-bucket/private.pdf \
  --duration=1h \
  --private-key-file=key.json

# Or sign via impersonation, no key file needed
gcloud storage sign-url gs://my-bucket/private.pdf \
  --duration=1h \
  --impersonate-service-account=sa@proj.iam.gserviceaccount.com

# lifecycle.json — delete objects older than 30 days
cat lifecycle.json

{
  "rule": [
    {
      "action": { "type": "Delete" },
      "condition": { "age": 30 }
    },
    {
      "action": { "type": "SetStorageClass", "storageClass": "NEARLINE" },
      "condition": { "age": 7, "matchesStorageClass": ["STANDARD"] }
    }
  ]
}

# Apply lifecycle policy
gcloud storage buckets update gs://my-bucket \
  --lifecycle-file=lifecycle.json

# Inspect object metadata
gcloud storage objects describe gs://my-bucket/file.txt

# List all versions of an object
gcloud storage ls -a gs://my-bucket/file.txt

# Restore a previous version (copy it back)
gcloud storage cp \
  gs://my-bucket/file.txt#GENERATION_NUMBER \
  gs://my-bucket/file.txt

# Push GCS events to a Pub/Sub topic
gcloud storage buckets notifications create gs://my-bucket \
  --topic=my-topic \
  --event-types=OBJECT_FINALIZE,OBJECT_DELETE

# gsutil equivalents — prefer `gcloud storage` for new scripts
gsutil cp file.txt gs://my-bucket/
gsutil rsync -r ./dir gs://my-bucket/dir
gsutil ls -l gs://my-bucket/
gsutil rm -r gs://my-bucket/dir/
gsutil acl ch -u allUsers:R gs://my-bucket/file.txt