Skip to main content

GOOGLE CLOUD STORAGE EXTENSIONS

Every Swamp extension that covers Google Cloud Storage, as published in the registry. Install any of them with swamp extension pull.

Extensions

Extension Version License Contents
@swamp/gcs-datastore 2026.10.13.1 - 1 datastores
@swamp/gcs-datastore-bootstrap 2026.10.13.1 - 1 behavior types, 1 workflows
@swamp/gcp/storage 2026.10.13.1 - 12 behavior types

@swamp/gcs-datastore

swamp extension pull @swamp/gcs-datastore

Datastore type @swamp/gcs-datastore

Store data in a Google Cloud Storage bucket with local cache synchronization.

Name Type Required Description
bucket string yes GCS bucket name
prefix string no Object name prefix within the bucket
projectId string no GCP project ID (defaults to ADC project)
apiEndpoint string no Custom API endpoint URL (for emulators like fake-gcs-server)
pullConcurrency number no Maximum concurrent GCS downloads during pull. Default: 50
pushConcurrency number no Maximum concurrent GCS uploads during push. Default: 25
requestTimeoutMs number no Per-request timeout in milliseconds. Default: 30000.

@swamp/gcs-datastore-bootstrap

swamp extension pull @swamp/gcs-datastore-bootstrap

Behavior type @swamp/gcs-datastore-bootstrap/provisioner

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
bucket_name string yes GCS bucket name to create.
project_id string yes GCP project ID that will own the bucket and the custom IAM role.
location string yes GCS location (e.g. US, us-central1, NAM4). Set at bucket creation and not patchable afterwards.
prefix string no Optional object-name prefix within the bucket (surfaced in state for the setup step).
role_id string no Custom IAM role ID. Defaults to swampGcsDatastore_<bucket_name_with_hyphens_as_underscores>.

Methods, run with swamp behavior run:

Method Description Arguments
provision Create/verify the GCS bucket and the scoped custom IAM role for @swamp/gcs-datastore. -

Data written:

Resource Description
state GCS bucket + project-scoped custom IAM role provisioned for swamp.

Workflows in @swamp/gcs-datastore-bootstrap

Workflow Description
@swamp/bootstrap-gcs-datastore Provision a GCS bucket + least-privilege project-scoped custom IAM role for @swamp/gcs-datastore, then switch the current repo to use GCS.

@swamp/gcp/storage

swamp extension pull @swamp/gcp/storage

Behavior type @swamp/gcp/storage/anywherecaches

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessToken string no GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson string no GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project string no GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes string no Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
quotaProject string no GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials.
apiEndpoint string no Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL.
admissionPolicy string no The cache-level entry admission policy.
anywhereCacheId string no The ID of the Anywhere cache instance.
bucket string no The name of the bucket containing this cache instance.
createTime string no The creation time of the cache instance in RFC 3339 format.
id string no The ID of the resource, including the project number, bucket name and anywhere cache ID.
ingestOnWrite boolean no Specifies whether objects are ingested into the cache upon write.
pendingUpdate boolean no True if the cache instance has an active Update long-running operation.
state string no The current state of the cache instance.
ttl string no The TTL of all cache entries in whole seconds. e.g., "7200s".
updateTime string no The modification time of the cache instance metadata in RFC 3339 format.
zone string no The zone in which the cache instance is running. For example, us-central1-a.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a anywhereCaches -
get Get a anywhereCaches identifier
update Update anywhereCaches attributes identifier (optional)
sync Sync anywhereCaches state from GCP identifier (optional)
list List anywhereCaches resources pageSize (optional), maxPages (optional)
disable disable -
pause pause -
resume resume -

Data written:

Resource Description
state An Anywhere Cache instance.

Behavior type @swamp/gcp/storage/bucketaccesscontrols

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessToken string no GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson string no GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project string no GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes string no Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
quotaProject string no GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials.
apiEndpoint string no Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL.
bucket string no The name of the bucket.
domain string no The domain associated with the entity, if any.
email string no The email address associated with the entity, if any.
entity string no The entity holding the permission, in one of the following forms: - user-userId - user-email - group-groupId - group-email - domain-domain - project-team-projectId - allUsers - allAuthenticatedUsers Examples: - The user liz@example.com would be user-liz@example.com. - The group example@googlegroups.com would be group-example@googlegroups.com. - To refer to all members of the Google Apps for Business domain example.com, the entity would be domain-example.com.
entityId string no The ID for the entity, if any.
id string no The ID of the access-control entry.
projectTeam object {projectNumber?: string, team?: string} no The project team associated with the entity, if any.
role string no The access permission for the entity.
userProject string no The project to be billed for this request. Required for Requester Pays buckets.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a bucketAccessControls -
get Get a bucketAccessControls identifier
update Update bucketAccessControls attributes identifier (optional)
delete Delete the bucketAccessControls identifier
sync Sync bucketAccessControls state from GCP identifier (optional)
list List bucketAccessControls resources userProject (optional), maxPages (optional)

Data written:

Resource Description
state An access-control entry.

Behavior type @swamp/gcp/storage/buckets

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessToken string no GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson string no GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
scopes string no Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
quotaProject string no GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials.
apiEndpoint string no Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL.
acl array of object {bucket?: string, domain?: string, email?: string, entity?: string, entityId?: string, etag?: string, id?: string, kind?: string, projectTeam?: object {projectNumber?: string, team?: string}, role?: string, selfLink?: string} no Access controls on the bucket.
autoclass object {enabled?: boolean, terminalStorageClass?: string, terminalStorageClassUpdateTime?: string, toggleTime?: string} no The bucket's Autoclass configuration.
billing object {requesterPays?: boolean} no The bucket's billing configuration.
cors array of object {maxAgeSeconds?: integer, method?: array of string, origin?: array of string, responseHeader?: array of string} no The bucket's Cross-Origin Resource Sharing (CORS) configuration.
customPlacementConfig object {dataLocations?: array of string} no The bucket's custom placement configuration for Custom Dual Regions.
defaultEventBasedHold boolean no The default value for event-based hold on newly created objects in this bucket. Event-based hold is a way to retain objects indefinitely until an event occurs, signified by the hold's release. After being released, such objects will be subject to bucket-level retention (if any). One sample use case of this flag is for banks to hold loan documents for at least 3 years after loan is paid in full. Here, bucket-level retention is 3 years and the event is loan being paid in full. In this example, these objects will be held intact for any number of years until the event has occurred (event-based hold on the object is released) and then 3 more years after that. That means retention duration of the objects begins from the moment event-based hold transitioned from true to false. Objects under event-based hold cannot be deleted, overwritten or archived until the hold is removed.
defaultObjectAcl array of object {bucket?: string, domain?: string, email?: string, entity?: string, entityId?: string, etag?: string, generation?: string, id?: string, kind?: string, object?: string, projectTeam?: object {projectNumber?: string, team?: string}, role?: string, selfLink?: string} no Default access controls to apply to new objects when no ACL is provided.
encryption object {customerManagedEncryptionEnforcementConfig?: object {effectiveTime?: string, restrictionMode?: "NotRestricted" | "FullyRestricted"}, customerSuppliedEncryptionEnforcementConfig?: object {effectiveTime?: string, restrictionMode?: "NotRestricted" | "FullyRestricted"}, defaultKmsKeyName?: string, googleManagedEncryptionEnforcementConfig?: object {effectiveTime?: string, restrictionMode?: "NotRestricted" | "FullyRestricted"}} no Encryption configuration for a bucket.
generation string no The generation of this bucket.
hardDeleteTime string no The hard delete time of the bucket in RFC 3339 format.
hierarchicalNamespace object {enabled?: boolean} no The bucket's hierarchical namespace configuration.
iamConfiguration object {bucketPolicyOnly?: object {enabled?: boolean, lockedTime?: string}, publicAccessPrevention?: string, uniformBucketLevelAccess?: object {enabled?: boolean, lockedTime?: string}} no The bucket's IAM configuration.
id string no The ID of the bucket. For buckets, the id and name properties are the same.
ipFilter object {allowAllServiceAgentAccess?: boolean, allowCrossOrgVpcs?: boolean, mode?: string, publicNetworkSource?: object {allowedIpCidrRanges?: array of string}, vpcNetworkSources?: array of object {allowedIpCidrRanges?: array, network?: string}} no The bucket's IP filter configuration. Specifies the network sources that are allowed to access the operations on the bucket, as well as its underlying objects. Only enforced when the mode is set to 'Enabled'.
labels object no User-provided labels, in key/value pairs.
lifecycle object {rule?: array of object {action?: object, condition?: object}} no The bucket's lifecycle configuration. See Lifecycle Management for more information.
location string no The location of the bucket. Object data for objects in the bucket resides in physical storage within this region. Defaults to US. See the Developer's Guide for the authoritative list.
locationType string no The type of the bucket location.
logging object {logBucket?: string, logObjectPrefix?: string} no The bucket's logging configuration, which defines the destination bucket and optional name prefix for the current bucket's logs.
metageneration string no The metadata generation of this bucket.
name string no The name of the bucket.
objectRetention object {mode?: string} no The bucket's object retention config.
owner object {entity?: string, entityId?: string} no The owner of the bucket. This is always the project team's owner group.
projectNumber string no The project number of the project the bucket belongs to.
retentionPolicy object {effectiveTime?: string, isLocked?: boolean, retentionPeriod?: string} no The bucket's retention policy. The retention policy enforces a minimum retention time for all objects contained in the bucket, based on their creation time. Any attempt to overwrite or delete objects younger than the retention period will result in a PERMISSION_DENIED error. An unlocked retention policy can be modified or removed from the bucket via a storage.buckets.update operation. A locked retention policy cannot be removed or shortened in duration for the lifetime of the bucket. Attempting to remove or decrease period of a locked retention policy will result in a PERMISSION_DENIED error.
rpo string no The Recovery Point Objective (RPO) of this bucket. Set to ASYNC_TURBO to turn on Turbo Replication on a bucket.
satisfiesPZI boolean no Reserved for future use.
satisfiesPZS boolean no Reserved for future use.
softDeletePolicy object {effectiveTime?: string, hardDeletePause?: object {effectiveTime?: string, enabled?: boolean}, retentionDurationSeconds?: string} no The bucket's soft delete policy, which defines the period of time that soft-deleted objects will be retained, and cannot be permanently deleted.
softDeleteTime string no The soft delete time of the bucket in RFC 3339 format.
storageClass string no The bucket's default storage class, used whenever no storageClass is specified for a newly-created object. This defines how objects in the bucket are stored and determines the SLA and the cost of storage. Values include MULTI_REGIONAL, REGIONAL, STANDARD, NEARLINE, COLDLINE, ARCHIVE, and DURABLE_REDUCED_AVAILABILITY. If this value is not specified when the bucket is created, it will default to STANDARD. For more information, see Storage Classes.
timeCreated string no The creation time of the bucket in RFC 3339 format.
updated string no The modification time of the bucket in RFC 3339 format.
versioning object {enabled?: boolean} no The bucket's versioning configuration.
website object {mainPageSuffix?: string, notFoundPage?: string} no The bucket's website configuration, controlling how the service behaves when accessing bucket contents as a web site. See the Static Website Examples for more information.
enableObjectRetention string no When set to true, object retention is enabled for this bucket.
predefinedAcl string no Apply a predefined set of access controls to this bucket.
predefinedDefaultObjectAcl string no Apply a predefined set of default object access controls to this bucket.
project string no A valid API project identifier.
projection string no Set of properties to return. Defaults to noAcl, unless the bucket resource specifies acl or defaultObjectAcl properties, when it defaults to full.
userProject string no The project to be billed for this request.
ifMetagenerationMatch string no Makes the return of the bucket metadata conditional on whether the bucket's current metageneration matches the given value.
ifMetagenerationNotMatch string no Makes the return of the bucket metadata conditional on whether the bucket's current metageneration does not match the given value.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a buckets -
get Get a buckets identifier
update Update buckets attributes identifier (optional)
delete Delete the buckets identifier
sync Sync buckets state from GCP identifier (optional)
list List buckets resources maxResults (optional), prefix (optional), project (optional), projection (optional), returnPartialSuccess (optional), softDeleted (optional), userProject (optional), maxPages (optional)
get_iam_policy get iam policy optionsRequestedPolicyVersion (optional), userProject (optional)
get_storage_layout get storage layout prefix (optional)
lock_retention_policy lock retention policy userProject (optional)
relocate relocate destinationCustomPlacementConfig (optional), destinationKmsKeyName (optional), destinationLocation (optional), validateOnly (optional)
restore restore projection (optional), userProject (optional)
set_iam_policy set iam policy bindings (optional), etag (optional), kind (optional), resourceId (optional), version (optional), userProject (optional)
test_iam_permissions test iam permissions userProject (optional)
add_iam_binding add an IAM binding to the bucket (read-modify-write with etag) role, members, condition (optional)
remove_iam_binding remove an IAM binding or specific members from a bucket (read-modify-write with etag) role, members (optional), condition (optional)

Data written:

Resource Description
state A bucket.

Behavior type @swamp/gcp/storage/defaultobjectaccesscontrols

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessToken string no GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson string no GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project string no GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes string no Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
quotaProject string no GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials.
apiEndpoint string no Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL.
bucket string no The name of the bucket.
domain string no The domain associated with the entity, if any.
email string no The email address associated with the entity, if any.
entity string no The entity holding the permission, in one of the following forms: - user-userId - user-email - group-groupId - group-email - domain-domain - project-team-projectId - allUsers - allAuthenticatedUsers Examples: - The user liz@example.com would be user-liz@example.com. - The group example@googlegroups.com would be group-example@googlegroups.com. - To refer to all members of the Google Apps for Business domain example.com, the entity would be domain-example.com.
entityId string no The ID for the entity, if any.
generation string no The content generation of the object, if applied to an object.
id string no The ID of the access-control entry.
object string no The name of the object, if applied to an object.
projectTeam object {projectNumber?: string, team?: string} no The project team associated with the entity, if any.
role string no The access permission for the entity.
userProject string no The project to be billed for this request. Required for Requester Pays buckets.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a defaultObjectAccessControls -
get Get a defaultObjectAccessControls identifier
update Update defaultObjectAccessControls attributes identifier (optional)
delete Delete the defaultObjectAccessControls identifier
sync Sync defaultObjectAccessControls state from GCP identifier (optional)
list List defaultObjectAccessControls resources ifMetagenerationMatch (optional), ifMetagenerationNotMatch (optional), userProject (optional), maxPages (optional)

Data written:

Resource Description
state An access-control entry.

Behavior type @swamp/gcp/storage/folders

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessToken string no GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson string no GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project string no GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes string no Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
quotaProject string no GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials.
apiEndpoint string no Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL.
bucket string no The name of the bucket containing this folder.
createTime string no The creation time of the folder in RFC 3339 format.
id string no The ID of the folder, including the bucket name, folder name.
metageneration string no The version of the metadata for this folder. Used for preconditions and for detecting changes in metadata.
name string no The name of the folder. Required if not specified by URL parameter.
pendingRenameInfo object {operationId?: string} no Only present if the folder is part of an ongoing rename folder operation. Contains information which can be used to query the operation status.
updateTime string no The modification time of the folder metadata in RFC 3339 format.
recursive string no If true, any parent folder which doesn't exist will be created automatically.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a folders -
get Get a folders identifier
delete Delete the folders identifier
sync Sync folders state from GCP identifier (optional)
list List folders resources delimiter (optional), endOffset (optional), pageSize (optional), prefix (optional), startOffset (optional), maxPages (optional)
rename rename ifSourceMetagenerationMatch (optional), ifSourceMetagenerationNotMatch (optional)

Data written:

Resource Description
state A folder. Only available in buckets with hierarchical namespace enabled.

Behavior type @swamp/gcp/storage/hmackeys

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessToken string no GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson string no GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project string no GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes string no Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
quotaProject string no GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials.
apiEndpoint string no Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL.
accessId string no The ID of the HMAC Key.
etag string no HTTP 1.1 Entity tag for the HMAC key.
id string no The ID of the HMAC key, including the Project ID and the Access ID.
kind string no The kind of item this is. For HMAC Key metadata, this is always storage#hmacKeyMetadata.
projectId string no Project ID owning the service account to which the key authenticates.
selfLink string no The link to this resource.
serviceAccountEmail string no The email address of the key's associated service account.
state string no The state of the key. Can be one of ACTIVE, INACTIVE, or DELETED.
timeCreated string no The creation time of the HMAC key in RFC 3339 format.
updated string no The last modification time of the HMAC key metadata in RFC 3339 format.
userProject string no The project to be billed for this request.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a hmacKeys -
get Get a hmacKeys identifier
update Update hmacKeys attributes identifier (optional)
delete Delete the hmacKeys identifier
sync Sync hmacKeys state from GCP identifier (optional)
list List hmacKeys resources maxResults (optional), serviceAccountEmail (optional), showDeletedKeys (optional), userProject (optional), maxPages (optional)

Data written:

Resource Description
state JSON template to produce a JSON-style HMAC Key metadata resource.

Behavior type @swamp/gcp/storage/managedfolders

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessToken string no GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson string no GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project string no GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes string no Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
quotaProject string no GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials.
apiEndpoint string no Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL.
bucket string no The name of the bucket containing this managed folder.
createTime string no The creation time of the managed folder in RFC 3339 format.
id string no The ID of the managed folder, including the bucket name and managed folder name.
metageneration string no The version of the metadata for this managed folder. Used for preconditions and for detecting changes in metadata.
name string no The name of the managed folder. Required if not specified by URL parameter.
rapidCacheConfig object {policies?: object} no The rapid cache configuration for the managed folder.
updateTime string no The last update time of the managed folder metadata in RFC 3339 format.
ifMetagenerationMatch string no Makes the operation conditional on whether the metageneration of the managed folder matches the specified value.
ifMetagenerationNotMatch string no Makes the operation conditional on whether the metageneration of the managed folder doesn't match the specified value.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a managedFolders -
get Get a managedFolders identifier
update Update managedFolders attributes identifier (optional)
delete Delete the managedFolders identifier
sync Sync managedFolders state from GCP identifier (optional)
list List managedFolders resources pageSize (optional), prefix (optional), maxPages (optional)
get_iam_policy get iam policy optionsRequestedPolicyVersion (optional), userProject (optional)
set_iam_policy set iam policy bindings (optional), etag (optional), kind (optional), resourceId (optional), version (optional), userProject (optional)
test_iam_permissions test iam permissions userProject (optional)

Data written:

Resource Description
state A managed folder.

Behavior type @swamp/gcp/storage/notifications

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessToken string no GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson string no GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project string no GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes string no Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
quotaProject string no GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials.
apiEndpoint string no Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL.
custom_attributes object no An optional list of additional attributes to attach to each Cloud PubSub message published for this notification subscription.
event_types array of string no If present, only send notifications about listed event types. If empty, sent notifications for all event types.
id string no The ID of the notification.
object_name_prefix string no If present, only apply this notification configuration to object names that begin with this prefix.
payload_format string no The desired content of the Payload.
topic string no The Cloud PubSub topic to which this subscription publishes. Formatted as: '//pubsub.googleapis.com/projects/{project-identifier}/topics/{my-topic}'
bucket string yes The parent bucket of the notification.
userProject string no The project to be billed for this request. Required for Requester Pays buckets.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a notifications -
get Get a notifications identifier
delete Delete the notifications identifier
sync Sync notifications state from GCP identifier (optional)
list List notifications resources userProject (optional), maxPages (optional)

Data written:

Resource Description
state A subscription to receive Google PubSub notifications.

Behavior type @swamp/gcp/storage/objectaccesscontrols

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessToken string no GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson string no GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project string no GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes string no Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
quotaProject string no GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials.
apiEndpoint string no Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL.
bucket string no The name of the bucket.
domain string no The domain associated with the entity, if any.
email string no The email address associated with the entity, if any.
entity string no The entity holding the permission, in one of the following forms: - user-userId - user-email - group-groupId - group-email - domain-domain - project-team-projectId - allUsers - allAuthenticatedUsers Examples: - The user liz@example.com would be user-liz@example.com. - The group example@googlegroups.com would be group-example@googlegroups.com. - To refer to all members of the Google Apps for Business domain example.com, the entity would be domain-example.com.
entityId string no The ID for the entity, if any.
generation string no The content generation of the object, if applied to an object.
id string no The ID of the access-control entry.
object string no The name of the object, if applied to an object.
projectTeam object {projectNumber?: string, team?: string} no The project team associated with the entity, if any.
role string no The access permission for the entity.
userProject string no The project to be billed for this request. Required for Requester Pays buckets.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a objectAccessControls -
get Get a objectAccessControls identifier
update Update objectAccessControls attributes identifier (optional)
delete Delete the objectAccessControls identifier
sync Sync objectAccessControls state from GCP identifier (optional)
list List objectAccessControls resources generation (optional), userProject (optional), maxPages (optional)

Data written:

Resource Description
state An access-control entry.

Behavior type @swamp/gcp/storage/objects

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
accessToken string no GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson string no GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project string no GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes string no Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
quotaProject string no GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials.
apiEndpoint string no Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL.
acl array of object {bucket?: string, domain?: string, email?: string, entity?: string, entityId?: string, etag?: string, generation?: string, id?: string, kind?: string, object?: string, projectTeam?: object {projectNumber?: string, team?: string}, role?: string, selfLink?: string} no Access controls on the object.
bucket string no The name of the bucket containing this object.
cacheControl string no Cache-Control directive for the object data. If omitted, and the object is accessible to all anonymous users, the default will be public, max-age=3600.
componentCount integer no Number of underlying components that make up this object. Components are accumulated by compose operations.
contentDisposition string no Content-Disposition of the object data.
contentEncoding string no Content-Encoding of the object data.
contentLanguage string no Content-Language of the object data.
contentType string no Content-Type of the object data. If an object is stored without a Content-Type, it is served as application/octet-stream.
contexts object {custom?: object} no User-defined or system-defined object contexts. Each object context is a key-payload pair, where the key provides the identification and the payload holds the associated value and additional metadata.
crc32c string no CRC32c checksum, as described in RFC 4960, Appendix B; encoded using base64 in big-endian byte order. For more information about using the CRC32c checksum, see Data Validation and Change Detection.
customTime string no A timestamp in RFC 3339 format specified by the user for an object.
customerEncryption object {encryptionAlgorithm?: string, keySha256?: string} no Metadata of customer-supplied encryption key, if the object is encrypted by such a key.
eventBasedHold boolean no Whether an object is under event-based hold. Event-based hold is a way to retain objects until an event occurs, which is signified by the hold's release (i.e. this value is set to false). After being released (set to false), such objects will be subject to bucket-level retention (if any). One sample use case of this flag is for banks to hold loan documents for at least 3 years after loan is paid in full. Here, bucket-level retention is 3 years and the event is the loan being paid in full. In this example, these objects will be held intact for any number of years until the event has occurred (event-based hold on the object is released) and then 3 more years after that. That means retention duration of the objects begins from the moment event-based hold transitioned from true to false.
generation string no The content generation of this object. Used for object versioning.
hardDeleteTime string no This is the time (in the future) when the soft-deleted object will no longer be restorable. It is equal to the soft delete time plus the current soft delete retention duration of the bucket.
id string no The ID of the object, including the bucket name, object name, and generation number.
kmsKeyName string no Not currently supported. Specifying the parameter causes the request to fail with status code 400 - Bad Request.
md5Hash string no MD5 hash of the data; encoded using base64. For more information about using the MD5 hash, see Data Validation and Change Detection.
mediaLink string no Media download link.
metadata object no User-provided metadata, in key/value pairs.
metageneration string no The version of the metadata for this object at this generation. Used for preconditions and for detecting changes in metadata. A metageneration number is only meaningful in the context of a particular generation of a particular object.
name string no The name of the object. Required if not specified by URL parameter.
owner object {entity?: string, entityId?: string} no The owner of the object. This will always be the uploader of the object.
restoreToken string no Restore token used to differentiate deleted objects with the same name and generation. This field is only returned for deleted objects in hierarchical namespace buckets.
retention object {mode?: string, retainUntilTime?: string} no A collection of object level retention parameters.
retentionExpirationTime string no A server-determined value that specifies the earliest time that the object's retention period expires. This value is in RFC 3339 format. Note 1: This field is not provided for objects with an active event-based hold, since retention expiration is unknown until the hold is removed. Note 2: This value can be provided even when temporary hold is set (so that the user can reason about policy without having to first unset the temporary hold).
size string no Content-Length of the data in bytes.
softDeleteTime string no The time at which the object became soft-deleted in RFC 3339 format.
storageClass string no Storage class of the object.
temporaryHold boolean no Whether an object is under temporary hold. While this flag is set to true, the object is protected against deletion and overwrites. A common use case of this flag is regulatory investigations where objects need to be retained while the investigation is ongoing. Note that unlike event-based hold, temporary hold does not impact retention expiration time of an object.
timeCreated string no The creation time of the object in RFC 3339 format.
timeDeleted string no The time at which the object became noncurrent in RFC 3339 format. Will be returned if and only if this version of the object has been deleted.
timeFinalized string no The time when the object was finalized.
timeStorageClassUpdated string no The time at which the object's storage class was last changed. When the object is initially created, it will be set to timeCreated.
updated string no The modification time of the object metadata in RFC 3339 format. Set initially to object creation time and then updated whenever any metadata of the object changes. This includes changes made by a requester, such as modifying custom metadata, as well as changes made by Cloud Storage on behalf of a requester, such as changing the storage class based on an Object Lifecycle Configuration.
ifGenerationMatch string no Makes the operation conditional on whether the object's current generation matches the given value. Setting to 0 makes the operation succeed only if there are no live versions of the object.
ifGenerationNotMatch string no Makes the operation conditional on whether the object's current generation does not match the given value. If no live object exists, the precondition fails. Setting to 0 makes the operation succeed only if there is a live version of the object.
ifMetagenerationMatch string no Makes the operation conditional on whether the object's current metageneration matches the given value.
ifMetagenerationNotMatch string no Makes the operation conditional on whether the object's current metageneration does not match the given value.
predefinedAcl string no Apply a predefined set of access controls to this object.
projection string no Set of properties to return. Defaults to noAcl, unless the object resource specifies the acl property, when it defaults to full.
userProject string no The project to be billed for this request. Required for Requester Pays buckets.
overrideUnlockedRetention string no Must be true to remove the retention configuration, reduce its unlocked retention period, or change its mode from unlocked to locked.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a objects -
get Get a objects identifier
update Update objects attributes identifier (optional)
delete Delete the objects identifier
sync Sync objects state from GCP identifier (optional)
list List objects resources delimiter (optional), endOffset (optional), filter (optional), includeFoldersAsPrefixes (optional), includeTrailingDelimiter (optional), matchGlob (optional), maxResults (optional), prefix (optional), projection (optional), softDeleted (optional), startOffset (optional), userProject (optional), versions (optional), maxPages (optional)
bulk_restore bulk restore allowOverwrite (optional), copySourceAcl (optional), createdAfterTime (optional), createdBeforeTime (optional), matchGlobs (optional), softDeletedAfterTime (optional), softDeletedBeforeTime (optional)
compose compose deleteSourceObjects (optional), destination (optional), kind (optional), sourceObjects (optional), destinationPredefinedAcl (optional), dropContextGroups (optional), ifGenerationMatch (optional), ifMetagenerationMatch (optional), kmsKeyName (optional), userProject (optional)
copy copy acl (optional), bucket (optional), cacheControl (optional), componentCount (optional), contentDisposition (optional), contentEncoding (optional), contentLanguage (optional), contentType (optional), contexts (optional), crc32c (optional), customTime (optional), customerEncryption (optional), etag (optional), eventBasedHold (optional), generation (optional), hardDeleteTime (optional), id (optional), kind (optional), kmsKeyName (optional), md5Hash (optional), mediaLink (optional), metadata (optional), metageneration (optional), name (optional), owner (optional), restoreToken (optional), retention (optional), retentionExpirationTime (optional), selfLink (optional), size (optional), softDeleteTime (optional), storageClass (optional), temporaryHold (optional), timeCreated (optional), timeDeleted (optional), timeFinalized (optional), timeStorageClassUpdated (optional), updated (optional), destinationKmsKeyName (optional), destinationPredefinedAcl (optional), ifGenerationMatch (optional), ifGenerationNotMatch (optional), ifMetagenerationMatch (optional), ifMetagenerationNotMatch (optional), ifSourceGenerationMatch (optional), ifSourceGenerationNotMatch (optional), ifSourceMetagenerationMatch (optional), ifSourceMetagenerationNotMatch (optional), projection (optional), sourceGeneration (optional), userProject (optional)
get_iam_policy get iam policy generation (optional), userProject (optional)
move move ifGenerationMatch (optional), ifGenerationNotMatch (optional), ifMetagenerationMatch (optional), ifMetagenerationNotMatch (optional), ifSourceGenerationMatch (optional), ifSourceGenerationNotMatch (optional), ifSourceMetagenerationMatch (optional), ifSourceMetagenerationNotMatch (optional), projection (optional), userProject (optional)
restore restore copySourceAcl (optional), ifGenerationMatch (optional), ifGenerationNotMatch (optional), ifMetagenerationMatch (optional), ifMetagenerationNotMatch (optional), projection (optional), restoreToken (optional), userProject (optional)
rewrite rewrite acl (optional), bucket (optional), cacheControl (optional), componentCount (optional), contentDisposition (optional), contentEncoding (optional), contentLanguage (optional), contentType (optional), contexts (optional), crc32c (optional), customTime (optional), customerEncryption (optional), etag (optional), eventBasedHold (optional), generation (optional), hardDeleteTime (optional), id (optional), kind (optional), kmsKeyName (optional), md5Hash (optional), mediaLink (optional), metadata (optional), metageneration (optional), name (optional), owner (optional), restoreToken (optional), retention (optional), retentionExpirationTime (optional), selfLink (optional), size (optional), softDeleteTime (optional), storageClass (optional), temporaryHold (optional), timeCreated (optional), timeDeleted (optional), timeFinalized (optional), timeStorageClassUpdated (optional), updated (optional), destinationKmsKeyName (optional), destinationPredefinedAcl (optional), dropContextGroups (optional), ifGenerationMatch (optional), ifGenerationNotMatch (optional), ifMetagenerationMatch (optional), ifMetagenerationNotMatch (optional), ifSourceGenerationMatch (optional), ifSourceGenerationNotMatch (optional), ifSourceMetagenerationMatch (optional), ifSourceMetagenerationNotMatch (optional), maxBytesRewrittenPerCall (optional), projection (optional), rewriteToken (optional), sourceGeneration (optional), userProject (optional)
set_iam_policy set iam policy bindings (optional), etag (optional), kind (optional), resourceId (optional), version (optional), generation (optional), userProject (optional)
test_iam_permissions test iam permissions generation (optional), userProject (optional)
view_full_context view full context contextKey (optional), generation (optional), userProject (optional)

Data written:

Resource Description
state An object.

Behavior type @swamp/gcp/storage/rapidcaches

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessToken string no GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson string no GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project string no GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes string no Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
quotaProject string no GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials.
apiEndpoint string no Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL.
admissionPolicy string no The cache-level entry admission policy.
bucket string no The name of the bucket containing this cache instance.
cacheType string no The type of Rapid Cache this represents. Valid values include: "rapid-cache" and "rapid-cache-ultra".
createTime string no The creation time of the cache instance in RFC 3339 format.
id string no The ID of the resource, including the project number, bucket name and rapid cache ID.
ingestOnWrite boolean no Specifies whether objects are ingested into the cache upon write.
pendingUpdate boolean no True if the cache instance has an active Update long-running operation.
rapidCacheId string no The ID of the Rapid cache instance.
state string no The current state of the cache instance.
ttl string no The TTL of all cache entries in whole seconds. e.g., "7200s".
updateTime string no The modification time of the cache instance metadata in RFC 3339 format.
zone string no The zone in which the cache instance is running. For example, us-central1-a.

Methods, run with swamp behavior run:

Method Description Arguments
create Create a rapidCaches -
get Get a rapidCaches identifier
update Update rapidCaches attributes identifier (optional)
sync Sync rapidCaches state from GCP identifier (optional)
list List rapidCaches resources pageSize (optional), maxPages (optional)
disable disable -

Data written:

Resource Description
state A Rapid Cache instance.

Behavior type @swamp/gcp/storage/serviceaccount

Global arguments, set with --global-arg on swamp behavior create:

Name Type Required Description
name string yes Instance name for this resource (used as the unique identifier in the factory pattern)
accessToken string no GCP OAuth2 access token; overrides GCP_ACCESS_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
credentialsJson string no GCP service account JSON credentials; overrides GOOGLE_APPLICATION_CREDENTIALS_JSON environment variable. Wire with a vault.get(...) expression to source it from a vault.
project string no GCP project ID; overrides GCP_PROJECT / GOOGLE_CLOUD_PROJECT environment variables.
scopes string no Comma-separated OAuth scopes to request when minting access tokens via gcloud. Defaults to the API's Discovery Document scopes.
quotaProject string no GCP project ID for quota and billing attribution; sets the x-goog-user-project header. Overrides GOOGLE_CLOUD_QUOTA_PROJECT environment variable. Required for APIs like Cloud Identity when using user credentials.
apiEndpoint string no Custom API endpoint for emulators; overrides GCP_API_ENDPOINT environment variable. Defaults to the service's production URL.

Methods, run with swamp behavior run:

Method Description Arguments
get Get a serviceAccount identifier
sync Sync serviceAccount state from GCP identifier (optional)

Data written:

Resource Description
state A subscription to receive Google PubSub notifications.