Grant Index access to your Google Cloud Storage bucket

Integration Partners
Last Updated: July 30, 2026•

Before you begin: Create your Google Cloud Storage bucket.

This topic explains how you can securely grant Index Exchange (Index) read access to a Google Cloud Storage (GCS) bucket using cross-account Identity and Access Management (IAM) roles.

Workflow

To grant access to Index, follow this workflow:

  1. Grant read access to your GCS bucket.

  2. Verify uniform bucket-level access.

  3. Share details with Index.

Note: Contact your Index Representative to request the Index service account email that Index provisions specifically for your account. This is a dedicated service account provisioned for each partner. You'll need this email address when granting Index permissions to your GCS bucket.

Grant access to your GCS bucket

Grant the Index' service account the Storage Object Viewer role on your GCS bucket, replacing <PARTNER_SERVICE_ACCOUNT_NAME> with the service account email that Index provisioned for you, and <PARTNER_BUCKET_NAME> with your GCS bucket name. The Storage Object Viewer role allows Index to view and list the segment files that you upload.

Note: It is optional but recommended that you scope access as narrowly as possible using an IAM Condition, rather than granting bucket-wide access. Index only needs read access either at the bucket level or scoped to folders via a Condition.

  1. Sign in to the Google Cloud console.

  2. Go to Cloud Storage > Buckets and select <PARTNER_BUCKET_NAME>.

  3. Click the Permissions tab, then click Grant Access.

  4. Under New principals, enter the <PARTNER_SERVICE_ACCOUNT_NAME>.

  5. Under Role, select Storage Object Viewer (roles/storage.objectViewer).

  6. Optional: To restrict access to a specific folder rather than the entire bucket:

    1. Click Add Condition.

    2. Enter a name (for example, index-read-path-only).

    3. Enter a expression such as resource.name.startsWith("projects/_/buckets/<PARTNER_BUCKET_NAME>/objects/path/").

    Segment files are typically organized by data type under top-level folders. A bucket may look like:

    gs://<PARTNER_BUCKET_NAME>/deviceip/
    gs://<PARTNER_BUCKET_NAME>/url/
    gs://<PARTNER_BUCKET_NAME>/id5/

  7. Click Save.

Verify uniform bucket-level access

GCS IAM bindings apply cleanly only when uniform bucket-level access is enabled on the bucket. While this is the default for new buckets, check your bucket's setting to ensure that legacy ACLs do not conflict with your IAM role.

On the Permissions tab, look for the Access control setting.

  • If the setting is Uniform, no changes are required.

  • If the setting is Fine-grained, consider switching to uniform access so that all access to the bucket is governed consistently through IAM: Click Edit access control, select Uniform, and click Save.

Share details with Index

After granting the IAM role to the Index service account, share your bucket's name, project ID, and folder structure with Index.

After you finish: Register your segments using a taxonomy file.