Google Cloud Storage (GCS) Bucket

Overview

The EQTY Governance Platform requires Google Cloud Storage (GCS) for blob storage.

Required buckets:

Governance artifacts bucket – Stores governance-related documents and artifacts
Integrity store bucket – Stores cryptographic proofs and audit trails

This guide covers:

Creating GCS buckets with proper configuration (gcloud CLI or Console)
Setting up a service account with storage permissions
Configuring the Helm chart for GCS storage

Prerequisites

Google Cloud Platform (GCP) account with an active project
gcloud CLI installed and configured (for CLI method)
Permissions to create buckets and service accounts in the GCP project

Helm Configuration

Add the following to the values.yaml and secrets.yaml files. Placeholders will be filled in throughout the steps below.

values.yaml:


    
     
      governance-service
      :
     
    
    
     
       
      config
      :
     
    
    
     
       
      storageProvider
      : 
      gcs
     
    
    
     
       
      gcsBucketName
      : 
      "
      
       
      "
       
      # Filled in after step 2
     
    
    
      
     
    
    
     
      integrity-service
      :
     
    
    
     
       
      config
      :
     
    
    
     
       
      integrityAppBlobStoreType
      : 
      gcs
     
    
    
     
       
      integrityAppBlobStoreGcsBucket
      : 
      "
      
       
      "
       
      # Filled in after step 2
     
    
    
     
       
      integrityAppBlobStoreGcsPrefix
      : 
      "
      rootstore
      "

secrets.yaml:


    
     
      global
      :
     
    
    
     
       
      secrets
      :
     
    
    
     
       
      create
      : 
      true
     
    
    
     
       
      storage
      :
     
    
    
     
       
      gcs
      :
     
    
    
     
       
      secretName
      : 
      platform-gcs
     
    
    
     
       
      values
      :
     
    
    
     
       
      serviceAccountJson
      : 
      "
      
       
      "
       
      # Filled in after step 5

Quick Start (CLI Method - Recommended)

1. Authenticate and Configure Project


    
     
      gcloud
       
      auth
       
      login

Set the following variables — they will be used throughout this guide. Replace the values with the ones for the deployment:


    
     
      PROJECT_ID
      =
      "
      your-gcp-project-id
      "
     
    
    
     
      GOVERNANCE_BUCKET
      =
      "
      governance-artifacts-bucket
      "
       
      # Must be globally unique
     
    
    
     
      INTEGRITY_BUCKET
      =
      "
      integrity-store-bucket
      "
       
      # Must be globally unique
     
    
    
     
      SERVICE_ACCOUNT_NAME
      =
      "
      governance-platform
      "
     
    
    
     
      REGION
      =
      "
      us-east1
      "

Set the active project:


    
     
      gcloud
       
      config
       
      set
       
      project
       
      $PROJECT_ID

Update values.yaml with the chosen bucket names.

values.yaml -> governance-service.config:


    
     
      gcsBucketName
      : 
      "
      
       
      "

values.yaml -> integrity-service.config:


    
     
      integrityAppBlobStoreGcsBucket
      : 
      "
      
       
      "

2. Create GCS Buckets

Create the governance artifacts bucket:


    
     
      gcloud
       
      storage
       
      buckets
       
      create
       
      gs://
      $GOVERNANCE_BUCKET
       
      \
     
    
    
     
       
      --location=$REGION
       
      \
     
    
    
     
       
      --uniform-bucket-level-access
       
      \
     
    
    
     
       
      --public-access-prevention

Create the integrity store bucket:


    
     
      gcloud
       
      storage
       
      buckets
       
      create
       
      gs://
      $INTEGRITY_BUCKET
       
      \
     
    
    
     
       
      --location=$REGION
       
      \
     
    
    
     
       
      --uniform-bucket-level-access
       
      \
     
    
    
     
       
      --public-access-prevention

Optionally enable versioning for data protection:


    
     
      gcloud
       
      storage
       
      buckets
       
      update
       
      gs://
      $GOVERNANCE_BUCKET
       
      --versioning


    
     
      gcloud
       
      storage
       
      buckets
       
      update
       
      gs://
      $INTEGRITY_BUCKET
       
      --versioning

Verify both buckets were created:


    
     
      gcloud
       
      storage
       
      buckets
       
      list
       
      --filter=
      "
      name:
      $GOVERNANCE_BUCKET
       OR name:
      $INTEGRITY_BUCKET
      "

3. Create Service Account


    
     
      gcloud
       
      iam
       
      service-accounts
       
      create
       
      $SERVICE_ACCOUNT_NAME
       
      \
     
    
    
     
       
      --display-name=
      "
      EQTY Governance Platform Service Account
      "
       
      \
     
    
    
     
       
      --description=
      "
      Service account for EQTY Governance Platform to access GCS buckets
      "

Set the service account email as a variable for use in subsequent commands:


    
     
      SERVICE_ACCOUNT_EMAIL
      =
      "
      ${
      SERVICE_ACCOUNT_NAME
      }@${
      PROJECT_ID
      }.iam.gserviceaccount.com
      "

4. Grant Bucket Permissions

Grant Storage Object Admin on the governance bucket:


    
     
      gcloud
       
      storage
       
      buckets
       
      add-iam-policy-binding
       
      gs://
      $GOVERNANCE_BUCKET
       
      \
     
    
    
     
       
      --member=
      "
      serviceAccount:
      $SERVICE_ACCOUNT_EMAIL
      "
       
      \
     
    
    
     
       
      --role=
      "
      roles/storage.objectAdmin
      "

Grant Storage Object Admin on the integrity bucket:


    
     
      gcloud
       
      storage
       
      buckets
       
      add-iam-policy-binding
       
      gs://
      $INTEGRITY_BUCKET
       
      \
     
    
    
     
       
      --member=
      "
      serviceAccount:
      $SERVICE_ACCOUNT_EMAIL
      "
       
      \
     
    
    
     
       
      --role=
      "
      roles/storage.objectAdmin
      "

Verify permissions were applied:


    
     
      gcloud
       
      storage
       
      buckets
       
      get-iam-policy
       
      gs://
      $GOVERNANCE_BUCKET
       
      \
     
    
    
     
       
      --flatten=
      "
      bindings[].members
      "
       
      \
     
    
    
     
       
      --filter=
      "
      bindings[].members:
      $SERVICE_ACCOUNT_EMAIL
      "

5. Create Service Account Key

Download the service account key as a JSON file:


    
     
      gcloud
       
      iam
       
      service-accounts
       
      keys
       
      create
       
      gcs-key.json
       
      \
     
    
    
     
       
      --iam-account=$SERVICE_ACCOUNT_EMAIL

Base64 encode the key for use in secrets.yaml:


    
     
      base64
       
      -w
       
      0
       
      gcs-key.json

Update secrets.yaml with the output.

secrets.yaml -> global.secrets.storage.gcs.values:


    
     
      serviceAccountJson
      : 
      "
      
       
      "

Delete gcs-key.json after adding the value to the Helm secrets.

Alternative: Web UI Setup

Click to expand Google Cloud Console instructions

Using the Google Cloud Console

1. Create GCS Buckets

Navigate to Cloud Storage Browser
Click “Create Bucket”
Enter a globally unique name for governance artifacts bucket
Choose a location (region or multi-region)
Select “Uniform” access control
Enable “Public access prevention”
Click “Create”
Repeat for integrity store bucket

Update values.yaml with the bucket names.

values.yaml -> governance-service.config:


     
      
       gcsBucketName
       : 
       "
       
        
       "

values.yaml -> integrity-service.config:


     
      
       integrityAppBlobStoreGcsBucket
       : 
       "
       
        
       "

2. Create Service Account

Navigate to IAM & Admin > Service Accounts
Click “Create Service Account”
Enter name: “governance-platform”
Enter description: “Service account for EQTY Governance Platform”
Click “Create and Continue”
Skip role assignment at this step (bucket-specific permissions are added next)
Click “Done”

3. Grant Bucket Permissions

Navigate to Cloud Storage Browser
For each bucket (governance artifacts and integrity store):
- Click on the bucket name
- Navigate to “Permissions” tab
- Click “Grant Access”
- Enter the service account email (e.g. governance-platform@PROJECT_ID.iam.gserviceaccount.com)
- Select role: “Storage Object Admin”
- Click “Save”

4. Create Service Account Key

Navigate to IAM & Admin > Service Accounts
Click on the service account name
Navigate to “Keys” tab
Click “Add Key” > “Create new key”
Select “JSON” format
Click “Create” (the key will download automatically)
Base64 encode the downloaded JSON file. Replace KEY_FILE_PATH with the path to the downloaded file:


     
      
       base64
        
       -w
        
       0
        
       KEY_FILE_PATH

Update secrets.yaml with the output.

secrets.yaml -> global.secrets.storage.gcs.values:


     
      
       serviceAccountJson
       : 
       "
       
        
       "

Verification

Activate the service account credentials locally:


    
     
      gcloud
       
      auth
       
      activate-service-account
       
      \
     
    
    
     
       
      --key-file=gcs-key.json

List objects in the governance artifacts bucket (should be empty initially):


    
     
      gcloud
       
      storage
       
      ls
       
      gs://
      $GOVERNANCE_BUCKET

List objects in the integrity store bucket (should be empty initially):


    
     
      gcloud
       
      storage
       
      ls
       
      gs://
      $INTEGRITY_BUCKET

Test write access on both buckets:


    
     
      echo
       
      "
      test
      "
       
      >
       
      test.txt
     
    
    
     
      gcloud
       
      storage
       
      cp
       
      test.txt
       
      gs://
      $GOVERNANCE_BUCKET
      /
     
    
    
     
      gcloud
       
      storage
       
      rm
       
      gs://
      $GOVERNANCE_BUCKET
      /test.txt
     
    
    
     
      gcloud
       
      storage
       
      cp
       
      test.txt
       
      gs://
      $INTEGRITY_BUCKET
      /
     
    
    
     
      gcloud
       
      storage
       
      rm
       
      gs://
      $INTEGRITY_BUCKET
      /test.txt
     
    
    
     
      rm
       
      test.txt

Return to normal authentication:


    
     
      gcloud
       
      auth
       
      revoke
       
      $SERVICE_ACCOUNT_EMAIL
     
    
    
     
      gcloud
       
      auth
       
      login

If the commands succeed without errors, the configuration is correct.

Security Best Practices

Least Privilege: Grant only the minimum required permissions (Storage Object Admin on specific buckets, not project-wide)
Rotate Keys: Regularly rotate service account keys and update Kubernetes secrets
Enable Versioning: Enable object versioning to protect against accidental deletion
Audit Logging: Enable Cloud Audit Logs for access monitoring
Encryption: GCS encrypts data at rest by default; consider customer-managed encryption keys (CMEK) for additional control