# Google Cloud Storage

URL: /collect/sources/google-cloud-storage

Read logs from a Cloud Storage bucket through a service account that holds the Storage Object Viewer role, so Foxborne can list and read objects and change nothing.



Connect a bucket once, and Foxborne reads new objects as they land under the prefix. It reads through a service account with the viewer role and never writes to the bucket.

## Before you start [#before-you-start]

* You need the **Admin** role.
* The bucket and prefix that hold the logs.
* A service account for Foxborne to read with, such as `foxborne-read@project.iam.gserviceaccount.com`.
* Rights to change the bucket's IAM policy.

## Give the service account read access [#give-the-service-account-read-access]

Grant the service account Storage Object Viewer, `roles/storage.objectViewer`, on the bucket. The role lists and reads objects, and it cannot create, overwrite or delete them.

Grant it on the bucket rather than the project, so the account reads nothing else. The connection test attempts a write and a delete, and confirms that both are refused.

## Connect the bucket [#connect-the-bucket]

<Steps>
  <Step title="Choose Google Cloud Storage">
    In **Sources**, select **Add source**, pick **Google Cloud Storage** under **Object storage** and select **Continue**. The card reads &#x2A;*A bucket read through a service account with the viewer role.**
  </Step>

  <Step title="Fill in the fields">
    | Field                 | Example in the console                          | What to enter                                    |
    | --------------------- | ----------------------------------------------- | ------------------------------------------------ |
    | **Name**              | For example: Fleet log archive, west range      | A name the team will recognize.                  |
    | **Bucket and prefix** | `gs://your-bucket/px4/`                         | The bucket, and the prefix the logs land under.  |
    | **Service account**   | `foxborne-read@project.iam.gserviceaccount.com` | The service account you granted the viewer role. |
    | **File pattern**      | `*.ulg`                                         | Which objects to read.                           |

    If the object paths name the vehicle, mark that part with `{vehicle}`, as in the pattern `{vehicle}/{yyyy-mm-dd}/*.ulg`. With a pattern such as `*.ulg`, Foxborne matches each flight log by the MAVLink system ID it records.
  </Step>

  <Step title="Test the connection">
    Select **Test connection**. Four checks appear one after another:

    | Check                    | Result                                             |
    | ------------------------ | -------------------------------------------------- |
    | **Resolve and connect.** | **Reached the location from the Foxborne worker.** |
    | **List objects.**        | **Read access confirmed.**                         |
    | **Attempt a write.**     | **Refused, as it should be.**                      |
    | **Attempt a delete.**    | **Refused, as it should be.**                      |
  </Step>

  <Step title="Add the source">
    Select **Add source**. The toast names the source and says &#x2A;*The first sync is running.**
  </Step>
</Steps>

## Check the result [#check-the-result]

* The source appears in **Connections** with **Read-only, verified** under **Access** and **Healthy** under **Status**.
* The drawer shows the bucket under **Location**, the service account under **Credential** and your pattern under **Matches**.
* **Guarantees** states &#x2A;*Every file is hashed with SHA-256 before parsing and stored unmodified.**
* The audit log records **Added source** with a detail such as **Google Cloud Storage, read-only test passed**.

## Troubleshoot [#troubleshoot]

* **Status shows Needs attention or Error.** Open the source's drawer and read the note at the top.
* **Files land on the wrong vehicle.** Check where `{vehicle}` sits in the pattern against the real object names. Or leave it out, and let the system ID in each flight log decide.
* **Runs from the bucket show Partial.** The bucket holds flight logs only. Bring in the journal and receive log through a collector, another source or **Import files**.

## Next [#next]

* [Connect a storage source](/collect/sources) covers every source type, the drawer and its actions.
* [Amazon S3 and S3-compatible storage](/collect/sources/amazon-s3) explains file patterns in more depth.
* [Supported file formats](/collect/formats) lists the formats a source can hold.