Google Cloud Storage Notification

This page shows how to write Terraform for Cloud Storage Notification and write them securely.

google_storage_notification (Terraform)

The Notification in Cloud Storage can be configured in Terraform with the resource name google_storage_notification. The following sections describe 3 examples of how to use the resource and its parameters.

Example Usage from GitHub
resource "google_storage_notification" "tfer--scoir-002D-csv-002F-cloud-002D-functions-002D-scoir-002D-318015-002D-f681c495f6625f20ap-002D-tp" {
  bucket         = "scoir-csv"
  payload_format = "JSON_API_V1"
  topic          = "//"
resource "google_storage_notification" "notification" {
  bucket         =
  payload_format = "JSON_API_V1"
  topic          =
  event_types    = ["OBJECT_FINALIZE"]
resource "google_storage_notification" "this" {
  bucket             = var.bucket
  custom_attributes  = var.custom_attributes
  event_types        = var.event_types
  object_name_prefix = var.object_name_prefix
  payload_format     = var.payload_format

Review your Terraform file for Google best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).


The name of the bucket.

A set of key/value attribute pairs to attach to each Cloud Pub/Sub message published for this notification subscription

List of event type filters for this notification config. If not specified, Cloud Storage will send notifications for all event types. The valid types are: "OBJECT_FINALIZE", "OBJECT_METADATA_UPDATE", "OBJECT_DELETE", "OBJECT_ARCHIVE"

The ID of the created notification.

Specifies a prefix path filter for this notification config. Cloud Storage will only send notifications for objects in this bucket whose names begin with the specified prefix.

The desired content of the Payload. One of "JSON_API_V1" or "NONE".

The URI of the created resource.

The Cloud Pub/Sub topic to which this subscription publishes. Expects either the topic name, assumed to belong to the default GCP provider project, or the project-level name, i.e. projects/my-gcp-project/topics/my-topic or my-topic. If the project is not set in the provider, you will need to use the project-level name.

Explanation in Terraform Registry

Creates a new notification configuration on a specified bucket, establishing a flow of event notifications from GCS to a Cloud Pub/Sub topic. For more information see the official documentation and API. In order to enable notifications, a special Google Cloud Storage service account unique to the project must exist and have the IAM permission "projects.topics.publish" for a Cloud Pub/Sub topic in the project. This service account is not created automatically when a project is created. To ensure the service account exists and obtain its email address for use in granting the correct IAM permission, use the google_storage_project_service_account datasource's email_address value, and see below for an example of enabling notifications by granting the correct IAM permission. See the notifications documentation for more details. >NOTE: This resource can affect your storage IAM policy. If you are using this in the same config as your storage IAM policy resources, consider making this resource dependent on those IAM resources via depends_on. This will safeguard against errors due to IAM race conditions.

Tips: Best Practices for The Other Google Cloud Storage Resources

In addition to the google_storage_bucket, Google Cloud Storage has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.



Ensure uniform bucket-level access of your GCS bucket is enabled

It is better to enable uniform bucket-level access of the GCS bucket. Uniform bucket-level access unifies and simplifies how you grant access to resources in the bucket.

Review your Google Cloud Storage settings

In addition to the above, there are other security points you should be aware of making sure that your .tf files are protected in Shisho Cloud.

Frequently asked questions

What is Google Cloud Storage Notification?

Google Cloud Storage Notification is a resource for Cloud Storage of Google Cloud Platform. Settings can be wrote in Terraform.

Where can I find the example code for the Google Cloud Storage Notification?

For Terraform, the erickertz/csv-exercise, yu-iskw/dbt-artifacts-loader and niveklabs/google source code examples are useful. See the Terraform Example section for further details.


Automate config file reviews on your commits

Fix issues in your infrastructure as code with auto-generated patches.