How do I back up to Google Cloud Storage?

Which type to use

BackupWall has two ways to reach Google Cloud Storage:

• Amazon S3 type with HMAC keys (recommended). Google's S3-compatible interface. Tested by PortWall on a 1 TB server: a full backup, an incremental and restores.
• Google Cloud Storage type (native). It accepts only a service account JSON key (the whole key file). It cannot use the server's attached service account or Application Default Credentials. Google Cloud organizations created since 2024 block creating service account keys by default (the policy iam.managed.disableServiceAccountKeyCreation), so there it has nothing to be given. It has had no real runs on record.

Set it up with HMAC keys (S3 type)

1. Create the bucket. Leave Object Lock and Object Versioning off.
2. Create a service account (IAM & Admin → Service accounts). It needs no key. On the bucket (Permissions), give it the role Storage Object Admin.
3. Make an HMAC key for that service account: Cloud Storage → Settings → Interoperability → Create a key for a service account, or gcloud storage hmac create <service-account-email>. Copy the access ID and the secret at once: the secret is shown only then. Some organizations restrict HMAC keys; your cloud administrator has to allow them.
4. In BackupWall open Destinations, choose + Add destination and the provider Amazon S3, and fill in:
   • Bucket name: the bucket name.
   • Region: the bucket's region in lower case, for example us-central1 (the field is required).
   • Access key ID: the HMAC access ID.
   • Secret access key: the HMAC secret.
   • Custom endpoint URL: https://storage.googleapis.com.
   • Path prefix: optional.
5. Choose Add destination, then Test on its card: "Connection successful".

Set it up with a service account key (native type)

1. Open Destinations, choose + Add destination and Google Cloud Storage.
2. Fill in Bucket name, paste the full key into Service account JSON, and optionally set Path prefix.
3. Choose Add destination, then Test.

Reading the data without BackupWall

A Google Cloud Storage destination reached through HMAC can be read with bw-extract --s3 BUCKET --endpoint https://storage.googleapis.com --s3-credentials hmac.json. For the native type, copy the bucket prefix to a local disk with rclone and use --local. See Get your files out without BackupWall.