Cloud StorageAuthorCloudBrum editorial teamLast reviewed27 Oct 2026Reading time~12 minLevelBeginner to advanced

• Buckets and objectsObjects live in buckets whose names are unique across Google Cloud. A single object can be up to 5 TiB, and the folder view in the console is only a display of name prefixes.
• Four classes, one APIStandard, Nearline, Coldline and Archive all use the same API and give millisecond access. The colder the class, the lower the storage price and the higher the read price and minimum storage time.
• Choose where it livesA region keeps data in one place, a dual-region pairs two regions, and a multi-region spreads across a large area such as the US or the EU.
• AutoclassLet Cloud Storage move objects between classes on its own, based on how they’re used, so you don’t need to guess the access pattern.
• Strongly consistentA read after a write returns the new data, and list calls are consistent too. Data is stored with 11 nines of annual durability.
• Soft delete by defaultDeleted objects are kept for seven days unless you change it, so most accidental deletes are recoverable. Versioning, retention policies and holds go further.
• Simple access modelUniform bucket-level access means IAM alone decides who gets in. Public access prevention blocks public sharing, and signed URLs give time-limited access to one object.
• Lifecycle and eventsRules change class or delete objects by age, and notifications through Pub/Sub or Eventarc start workflows when objects arrive.

Bucket

The container for objects. It has a globally unique name and a location, and it holds the settings for access, classes and lifecycle.

Object

A piece of data with a name, metadata and a generation number that changes each time the data is replaced.

Location type

Region, dual-region or multi-region. It’s chosen when the bucket is created and can’t be changed later.

Storage class

Standard, Nearline, Coldline or Archive. It sets storage and retrieval prices and the minimum storage duration (none, 30, 90 and 365 days).

Autoclass

A bucket setting that moves objects between classes automatically as their use changes.

Uniform bucket-level access

Turns off object ACLs so that IAM policies are the only way access is granted.

Public access prevention

A setting that blocks anything from being made public on a bucket or across an organisation.

Signed URL

A temporary link, signed with a service account key or through the IAM Credentials API, that gives access to one object.

Soft delete

Keeps deleted objects for a retention period, seven days by default, so they can be restored.

Object versioning

Keeps earlier generations of an object when it is overwritten or deleted.

Retention policy and Bucket Lock

A minimum time objects must be kept. Locking the policy makes it permanent, for records that mustn’t be changed.

Lifecycle rule

A condition and an action, such as change to Nearline after 30 days, or delete when the object has been noncurrent for 90.

Resumable upload

An upload that can be restarted after a failure, which is how large files are normally sent.

Requester pays

A bucket setting that bills the person downloading the data for the request and the network, instead of the bucket owner.

Create your first private bucket in the Google Cloud console

1. Open Cloud StorageChoose your project, then go to Cloud Storage and Buckets, and pick Create.
2. Name the bucketNames must be unique across Google Cloud, 3 to 63 characters, using lower-case letters, numbers, dashes and underscores. Don’t put anything sensitive in the name, because names are public.
3. Choose the locationPick a region near your users and compute, a dual-region for two-region resilience, or a multi-region for broad reach. You can’t change it later.
4. Choose a storage classStart with Standard unless you know the data is cold, or turn on Autoclass if you can’t tell. Colder classes cost more to read and have minimum storage times.
5. Control accessLeave Enforce public access prevention on, and choose Uniform access control so that IAM is the only door.
6. Protect the dataKeep soft delete at its default of seven days or raise it, and add object versioning if you need older copies.
7. Create it and upload a filePress Create and drag in a file. For large data use gcloud storage cp or an SDK, which upload in parts and can resume.
8. Give access to the right identitiesOn the Permissions tab, grant an application’s service account a role such as Storage Object User on this bucket only, and not at the project level.
9. Add a lifecycle rule and a budgetUnder Lifecycle, change the class or delete objects after the period that matches your use, and create a budget alert for the project.

• Keep the bucket in the same region as the compute that uses it, or use a multi-region bucket for content read from many places.
• Cache widely read content with Cloud CDN on a load balancer in front of the bucket; most requests then stop at the edge.
• Spread writes over object names. One name takes roughly one write per second, though a bucket as a whole scales much higher.
• Use parallel composite uploads and ranged reads for large files. gcloud storage does this automatically when it’s worthwhile.
• Ramp request rates up gradually. Buckets autoscale, and a sudden burst from zero can see 429 and 503 errors for a short time.
• Use Anywhere Cache to keep hot data close to compute in a zone, for read-heavy jobs such as training.
• Don’t store millions of tiny objects if you can batch them. Fewer, larger objects mean fewer requests and a lighter bill.
• Mount a bucket with Cloud Storage FUSE only where a file interface is truly needed. Direct API access is faster.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Cloud Storage.

• Start with Standard or turn on Autoclass when you can’t predict access. Move to colder classes only for data that you can show is cold.
• Use lifecycle rules for every bucket: change class, delete old data, and remove noncurrent versions.
• Mind the minimum durations: 30 days for Nearline, 90 for Coldline and 365 for Archive, plus retrieval fees. A wrong guess costs more than leaving the data in Standard.
• Watch operations. Class A operations (writes, lists) cost more than Class B (reads), and chatty applications can spend more on operations than on storage.
• Check egress. Data leaving Google Cloud, or going between regions, is billed. Keep compute in the same location and put a CDN in front of public content.
• Count soft-deleted data and noncurrent versions as live data for billing, and shorten how long you hold them.
• Choose the location type deliberately. Dual- and multi-region buckets cost more than a single region.
• Delete test buckets, old exports and orphaned data, and use the Storage Insights reports to find them.
• Consider committed use discounts only where you know the baseline for a year or more. Standard storage is billed per GB with no commitment otherwise.
• Label buckets by team and product, export billing data to BigQuery, and set budget alerts.

• Enforce public access prevention and uniform bucket-level access across the organisation with organisation policies.
• Give each application its own service account with a narrow role on a specific bucket, and avoid long-lived keys.
• Use workload identity or impersonation instead of downloaded keys, and block key creation where you can.
• Use signed URLs with short lifetimes, instead of making objects public.
• Turn on soft delete and versioning, and use retention policies with Bucket Lock for records.
• Encrypt with customer-managed keys in Cloud KMS where policy requires, and log key use.
• Enable Data Access audit logs for sensitive buckets and send them to a separate project.
• Use VPC Service Controls to keep data from leaving a perimeter, and Private Google Access for traffic from private VMs.
• Scan for sensitive data with Sensitive Data Protection and review findings.
• Review who has Storage Admin and who can change bucket settings, and keep the list short.

Use Cloud Audit Logs to see who changed a bucket or read an object, Organization Policy to enforce settings, Security Command Center for findings, and the Compliance Reports Manager for assurance reports. Cloud Storage is in scope for many programmes, but responsibility is shared: Google runs the service, and you own the identities, access settings, encryption choices and data.

• Hold less data. Anything nobody uses still sits on powered hardware, so deleting it comes first.
• Compress files and use compact formats, so there is less to store and less to push around.
• Use lifecycle rules or Autoclass so cold data sits in the classes meant for it.
• Let Cloud CDN answer repeat requests so the origin sends each popular object once.
• Create buckets in the location your workloads run in, which also cuts transfer over long distances.
• Pick a low-carbon region for large archives that don’t need low latency. Google publishes the carbon-free energy share of each region.
• The Google Cloud Carbon Footprint report gives estimated emissions for your usage. Read how it counts storage before you quote a figure.

Purchase options

What you actually pay for

• Storage, by class, location type and GB-month
• Operations (Class A and Class B)
• Retrieval fees on Nearline, Coldline and Archive, plus early-deletion charges
• Network egress, and replication between locations in dual- and multi-region buckets
• Features: Autoclass management, Anywhere Cache, soft-deleted data and others

A private bucket for user uploads, set up as you’d want it in production: public access prevention, uniform access, versioning, a longer soft delete and a lifecycle rule. gcloud and Terraform both build it. The Python and C# tabs upload an invoice and return a signed link that expires after 15 minutes. Put in your own project, bucket name, location and service account.

# Bucket names are global: change this one. Mumbai (asia-south1) is used as the example location.
PROJECT=my-project
BUCKET=acme-uploads-my-project
LOCATION=asia-south1
UPLOADER=uploader@$PROJECT.iam.gserviceaccount.com

# Private from the start: IAM only, and nothing can be made public
gcloud storage buckets create gs://$BUCKET --project=$PROJECT --location=$LOCATION \
  --default-storage-class=STANDARD --uniform-bucket-level-access --public-access-prevention

# Keep older versions, and deleted objects for 14 days instead of the default 7
gcloud storage buckets update gs://$BUCKET --versioning
gcloud storage buckets update gs://$BUCKET --soft-delete-duration=14d

# Nearline after 30 days, noncurrent versions deleted after 90
cat > lifecycle.json <<'JSON'
{
  "rule": [
    {"action": {"type": "SetStorageClass", "storageClass": "NEARLINE"},
     "condition": {"age": 30, "matchesStorageClass": ["STANDARD"], "isLive": true}},
    {"action": {"type": "Delete"},
     "condition": {"daysSinceNoncurrentTime": 90}}
  ]
}
JSON
gcloud storage buckets update gs://$BUCKET --lifecycle-file=lifecycle.json

# Let one service account create and read objects here, and nothing else
gcloud storage buckets add-iam-policy-binding gs://$BUCKET \
  --member=serviceAccount:$UPLOADER --role=roles/storage.objectUser

# Upload, then make a link that works for 15 minutes (signs through the IAM Credentials API)
gcloud storage cp ./invoice-1042.pdf gs://$BUCKET/invoices/2026/10/invoice-1042.pdf
gcloud storage sign-url gs://$BUCKET/invoices/2026/10/invoice-1042.pdf \
  --duration=15m --impersonate-service-account=$UPLOADER

# Assumes var.project_id, var.bucket_name (globally unique) and var.location (for example "asia-south1")
resource "google_storage_bucket" "uploads" {
  name                        = var.bucket_name
  project                     = var.project_id
  location                    = var.location
  storage_class               = "STANDARD"
  uniform_bucket_level_access = true
  public_access_prevention    = "enforced"
  force_destroy               = false  # refuse to delete a bucket that still has objects

  versioning {
    enabled = true
  }

  soft_delete_policy {
    retention_duration_seconds = 1209600  # 14 days
  }

  lifecycle_rule {
    condition {
      age                   = 30
      matches_storage_class = ["STANDARD"]
      with_state            = "LIVE"
    }
    action {
      type          = "SetStorageClass"
      storage_class = "NEARLINE"
    }
  }

  lifecycle_rule {
    condition {
      days_since_noncurrent_time = 90
    }
    action {
      type = "Delete"
    }
  }
}

resource "google_service_account" "uploader" {
  account_id   = "uploader"
  display_name = "Uploads writer"
  project      = var.project_id
}

resource "google_storage_bucket_iam_member" "uploader" {
  bucket = google_storage_bucket.uploads.name
  role   = "roles/storage.objectUser"
  member = "serviceAccount:${google_service_account.uploader.email}"
}

# pip install google-cloud-storage
import datetime

import google.auth
from google.auth.transport.requests import Request
from google.cloud import storage

BUCKET = "acme-uploads-my-project"

client = storage.Client()  # uses Application Default Credentials: a service account in Google Cloud, or your own login locally
bucket = client.bucket(BUCKET)


def upload_invoice(path, name):
    """Upload one file. Large files are sent with a resumable upload."""
    blob = bucket.blob(name)
    blob.metadata = {"team": "billing"}
    blob.upload_from_filename(path, content_type="application/pdf")


def download_link(name, minutes=15):
    """A V4 signed URL. Without a private key (Cloud Run, Compute Engine) it signs through the IAM Credentials API."""
    blob = bucket.blob(name)
    credentials, _ = google.auth.default()
    if getattr(credentials, "signer", None) is not None:
        return blob.generate_signed_url(version="v4", expiration=datetime.timedelta(minutes=minutes), method="GET")
    credentials.refresh(Request())
    return blob.generate_signed_url(
        version="v4",
        expiration=datetime.timedelta(minutes=minutes),
        method="GET",
        service_account_email=credentials.service_account_email,
        access_token=credentials.token,
    )


def list_prefix(prefix):
    """Object names under a prefix, fetched a page at a time by the library."""
    return [blob.name for blob in client.list_blobs(BUCKET, prefix=prefix)]


if __name__ == "__main__":
    name = "invoices/2026/10/invoice-1042.pdf"
    upload_invoice("invoice-1042.pdf", name)
    print(download_link(name))
    print(list_prefix("invoices/2026/10/"))

// Program.cs: upload an invoice, then print a signed link that expires in 15 minutes
// NuGet package: Google.Cloud.Storage.V1
using Google.Apis.Auth.OAuth2;
using Google.Cloud.Storage.V1;
using Object = Google.Apis.Storage.v1.Data.Object;

const string bucket = "acme-uploads-my-project";
const string name = "invoices/2026/10/invoice-1042.pdf";

// Application Default Credentials: a service account in Google Cloud, or your own login locally
var client = await StorageClient.CreateAsync();

// Upload with metadata; large files are sent with a resumable upload
var obj = new Object
{
    Bucket = bucket,
    Name = name,
    ContentType = "application/pdf",
    Metadata = new Dictionary<string, string> { ["team"] = "billing" }
};
using (var file = File.OpenRead("invoice-1042.pdf"))
{
    await client.UploadObjectAsync(obj, file);
}

// A V4 signed URL. Signing needs a service account key; on Cloud Run or Compute Engine, sign through the IAM Credentials API instead
var credential = (await GoogleCredential.GetApplicationDefaultAsync()).UnderlyingCredential as ServiceAccountCredential
    ?? throw new InvalidOperationException("Use a service account key, or sign through the IAM Credentials API.");
var signer = UrlSigner.FromCredential(credential);
Console.WriteLine(await signer.SignAsync(bucket, name, TimeSpan.FromMinutes(15), HttpMethod.Get));

// List objects under a prefix, page by page
await foreach (var item in client.ListObjectsAsync(bucket, "invoices/2026/10/"))
{
    Console.WriteLine($"{item.Name}  {item.Size} bytes");
}

Short walkthrough videos for this service are being prepared. They will appear here and load only when you press play. Until then, follow CloudBrum on YouTube for new videos.

Object storage isn't the only kind. Shared file systems for servers belong in Filestore, disks for virtual machines in Persistent Disk, and big analytical tables in BigQuery. To react when a file lands in a bucket, see Cloud Run functions.