Google Cloud Storage - Configuring Google Account Service Key

Getting Started

Before you begin, ensure you have:

• access to the Google Cloud console, with permission to create Service Accounts and keys (for example, the Service Account Admin and Service Account Key Admin roles, or project Owner)
• the name of the Cloud Storage bucket that holds the data you want to bring into One Model.
• an organization that allows Service Account key creation - many organizations block it by policy, and Google may enforce this by default. If key creation is blocked, use Workload Identity Federation instead, or ask your Google Cloud administrator for an exception.

How One Model stores and uses your Service Account key

One Model checks the JSON key file when you upload it. It keeps only the details needed to connect: the Service Account email, the key ID and the private key. The private key is stored encrypted and is never shown again after you save the connector. When the connector runs, One Model uses the key to request a short-lived access token from Google. It reuses that token until it expires, then requests a new one. Please keep the following in mind:

• Only JSON key files are supported. P12 key files are not supported.
• Ensure the key is kept in a secure location as connector changes may require the key to be re-uploaded (scopes may be updated without triggering a re-upload)
• To rotate the key, create a new key in Google, upload the new key file to the connector and save. Then delete the old key in Google.

Create a Project in Google Console

Google Cloud organizes resources and access controls into projects. The project holds your Service Account, its key, and the settings that control them. The Service Account doesn't need to be in the same project as your Cloud Storage bucket, because access to the bucket is granted separately in Grant the Service Account read access to your Cloud Storage bucket.

You can use an existing project. Alternatively, a dedicated project for this integration keeps your One Model access configuration separate and easy to audit. To create a new project, follow the steps below. If you're using an existing project, select it from the project picker and skip to Create a Service Account.

1. Go to the Google Console at https://console.cloud.google.com/apis/dashboard and select Create Project:  
2. Choose a Project Name,
3. confirm or change the Organization,
4. confirm or change the Parent Resource, and click Create:

Create a Service Account

The Service Account is the identity One Model uses when it reads your data. Creating a dedicated Service Account for One Model means you control exactly what it can access. You can also revoke access at any time without affecting other systems.

If your connector will read BigQuery tables, you’ll also grant the Service Account BigQuery access in this section. Skip that step if you only need files from Cloud Storage.

The Service Account's email address follows this format:<service-account-id>@<project-id>.iam.gserviceaccount.com. You'll see this email in the next steps when granting access.

1. From within your project, select IAM & Admin > Service Accounts:

    

2. In the Service Accounts screen, click Create Service Account:

    

3. Set a Service Account Name, Service Account ID (if different from the name), and description, 

4. Click Create and continue:

    
    

5. This step enables access to Cloud Storage BigQuery tables, you can skip this step if access to tables is not needed.  In the Select a role box, search for ‘BigQuery User’ and ‘BigQuery Data Viewer’, select each and click Done (Principals with Access does not need to be configured):

    

6. You will be returned to the Service Accounts screen and the details of the Service Account you created are displayed. Copy the service account email for the next step:

Grant the Service Account read access to your Cloud Storage bucket

This section enables access to Cloud Storage files, you can skip this section if access to files is not needed.  

IAM roles decide what the Service Account is allowed to do. Granting the role on the bucket, rather than on the whole project, limits One Model to the data in that bucket. The Storage Object Viewer role allows One Model to list and read files, but not change or delete them.

1. In the Google Cloud console, go to Cloud Storage > Buckets:  

    

2. Select the bucket that holds your data, then from the bucket’s menu, click Edit access:

    

3. In New principals, paste the Service Account email you copied in Create a Service Account,  
4. In Assign roles, search for and select Storage Object Viewer: 

5. Click Save:

    

Create and download the JSON key

The JSON key is the credential you'll upload to the One Model connector. It contains the Service Account email, a key ID and a private key that proves One Model's identity to Google. The key may be required for future updates to the One Model connector. Treat this file like a password and ensure it is stored securely.

1. On the Service Accounts screen, select the Service Account you just created:

    

2. You will see the Service Accounts details, click Keys:

    

3. From the Add Key dropdown, select Create new key:

    

4. Select JSON (note P12 keys are not supported in One Model) and

5. click Create:

    

6. The JSON key file will download to your computer only once, and should be stored in a secure location.  If the key is lost, a new one will need to be created and the One Model connector updated with the new key. The key file cannot be retrieved from the One Model connector after it has been uploaded:

Choose the OAuth scopes for your connector

OAuth scopes are not set in the Google Cloud console for a Service Account. Instead, you enter them in the connector's Scopes field. One Model includes them each time it requests an access token from Google.

How scopes and IAM roles work together
Scopes and IAM roles are two separate limits, and One Model can only do what both allow:
IAM roles (granted in Create a Service Account and Grant the Service Account read access to your Cloud Storage bucket) control which resources the Service Account can access and what it can do with them.
Scopes (entered in the connector) control which Google APIs the access token can be used with.

For example, with the devstorage.read_only scope and the Storage Object Viewer role, One Model can read files in your bucket. It can't access BigQuery, even if the Service Account has BigQuery roles, because the scope doesn't cover it.

If the connector returns an error such as insufficient authentication scopes, the scope doesn't cover the API being called. If it returns 403 Forbidden with a permission message, the scope is correct but the IAM role is missing.

Which scope to use
Choose the scope that matches the Google service your connector calls. Read-only scopes are recommended, because the Universal Connector only retrieves data.

Next Steps

You have now created a Google Service Account, granted it read access to your Cloud Storage bucket, and downloaded its JSON key. 
To complete the connector setup in the Universal Connector, select the GCP Service Account Key authentication type and provide:

• The JSON key file (created in Create and download the JSON key)
• The OAuth scope (chosen in Choose the OAuth scopes for your connector)
• Set a reminder to rotate the key in line with your organization's security policy.
• If you have questions about the setup, contact your One Model Customer Success team.