24  Google Cloud Storage Connector

Use this guide for a Google Cloud Storage connector. Nous indexes objects in the selected bucket and optional path prefix.

24.1 What is indexed or searched live

The connector indexes supported objects that the Google Cloud Storage HMAC credential can list and read. A path prefix limits the object keys. GCS access is separate from Nous Workspace and Team access.

24.2 Administrator role and authentication

A Google Cloud administrator or Storage administrator should create an HMAC key for a dedicated service account or user with least-privilege access. The customer creates the HMAC access key ID and secret. Do not use a personal key when a dedicated identity is available.

Grant the identity permission to list the bucket and read the selected objects. At minimum, review storage.objects.list and storage.objects.get for the bucket and prefix.

24.3 Provider setup and permissions

Create the HMAC key in the Google Cloud project that owns the service account. Apply a bucket IAM policy limited to the selected bucket and prefix. Copy the secret only into the credential form and rotate it under your cloud policy.

24.4 Setup form fields

Field What to enter
Name A unique workspace connector name.
Bucket Name The GCS bucket name, without gs://.
Path Prefix Optional object-key prefix, such as policies/2026/.
HMAC access key ID The customer-created GCS HMAC access key ID.
HMAC secret access key The matching HMAC secret.
Who has access Choose Everyone in the workspace or Specific Teams.

24.5 Workspace and Team access

GCS IAM controls what Nous can read. Nous access controls who can search the indexed result. Use Specific Teams for a limited audience. Portal manages Team membership. A Team share cannot grant access beyond the bucket IAM policy.

24.6 Test the connection

  1. Save the connector and wait for source sync and search indexing.
  2. Confirm that a known object in the selected prefix appears.
  3. Search for a phrase from the object content.
  4. Test as an intended Workspace or Team member.

24.7 Common errors

Error Action
Bucket list is denied Grant bucket list permission to the HMAC identity and check the bucket name.
Object read is denied Grant object read permission for the selected bucket and prefix.
HMAC key is invalid Check the key ID and secret, then create and test a replacement key.
No documents appear Check the prefix and wait for daily refresh and search indexing.

24.8 Reconnect, rotate, and remove

Create and test a replacement HMAC key before disabling the old one. Save the replacement in the connector and run a search. Before removal, check document sets, agents, and Team shares, then disable the old key.

24.9 Official provider documentation