GOOGLE CLOUD STORAGE WITH SWAMP

Managing Cloud Storage resources

The @swamp/gcp/storage extension provides one behavior type for each Cloud Storage resource: @swamp/gcp/storage/buckets, @swamp/gcp/storage/objects, @swamp/gcp/storage/folders and @swamp/gcp/storage/managedfolders, plus types for bucket, object and default object access controls, HMAC keys, Pub/Sub notifications, Anywhere Cache and Rapid Cache instances, and the project's Cloud Storage service account. A behavior holds one resource's configuration as global arguments. Its methods create, get, update, delete, sync and list record the resource's state as Swamp data, which workflows and later queries can read.

The buckets type also has methods for bucket IAM policies. add_iam_binding and remove_iam_binding change a single binding using a read-modify-write cycle with the policy etag. get_iam_policy, set_iam_policy and test_iam_permissions map to the Cloud Storage API calls of the same names. The objects type adds compose, copy, rewrite, move, restore and bulk_restore, and its list method filters by prefix, glob and delimiter.

These behaviors authenticate with Google Cloud Application Default Credentials or the GOOGLE_APPLICATION_CREDENTIALS_JSON and GCP_ACCESS_TOKEN environment variables. You can also wire the accessToken or credentialsJson global argument to a vault.get() expression so the credential comes from a vault.

The getting started tutorial pulls the extension into a new repository. The how-to guides cover granting a group read access to a bucket and listing the objects under a prefix. Every type, global argument and method is listed in the extensions reference.

Keeping repository data in Cloud Storage

The @swamp/gcs-datastore extension is a datastore provider. It stores a repository's data in a Cloud Storage bucket and keeps a local cache in sync with it in both directions. It takes locks with generation-based preconditions, so several machines and several repositories can share one bucket. It needs a bucket and accepts an optional prefix, projectId, apiEndpoint, transfer concurrency limits and a per-request timeout. It authenticates with Application Default Credentials and needs five storage permissions on the bucket.

The @swamp/gcs-datastore-bootstrap extension provides a provisioner behavior type and a bootstrap workflow. The workflow creates a private, versioned bucket and a project-scoped custom IAM role that grants only those five permissions, then switches the current repository over to the Cloud Storage datastore. Bootstrap a Cloud Storage datastore for a repository walks through it, and the datastore architecture page describes how datastores work in Swamp in general.

Understanding Google Cloud Storage automation in Swamp covers how these pieces relate and the decisions a team makes about access control, credentials and where repository data lives.