Property | Description |
|---|---|
Connection Name | Name of the connection. Each connection name must be unique within the organization. Connection names can contain alphanumeric characters, spaces, and the following special characters: _ . + -, Maximum length is 255 characters. |
Description | Description of the connection. Maximum length is 4000 characters. |
Use Secret Vault | Stores sensitive credentials for this connection in the secrets manager that is configured for your organization. This property appears only if secrets manager is set up for your organization. This property is not supported by Data Ingestion and Replication and the Data Access Management services. When you enable the secret vault in the connection, you can select the credentials that the Secure Agent retrieves from the secrets manager. If you don't enable this option, the credentials are stored in the repository or on a local Secure Agent, depending on how your organization is configured. Note: If you’re using this connection to apply data access policies through pushdown or proxy services, you cannot use the Secret Vault configuration option. For information about how to configure and use a secrets manager, see "Secrets manager configuration" in the Administrator help. |
Runtime Environment | The name of the runtime environment where you want to run tasks. Select a Secure Agent, Hosted Agent, or serverless runtime environment. For application ingestion and replication tasks and database ingestion and replication tasks, you can use the Secure Agent or serverless runtime environment. The tasks must have a source type supported for serverless use. For file ingestion and replication tasks and streaming ingestion and replication tasks, you can use only the Secure Agent. You cannot run tasks on a Hosted Agent or elastic runtime environment. For more information about runtime environments, see Runtime Environments in the Administrator help. |
Authentication Type | Description |
|---|---|
Service Account | Authenticate with the credentials in a Google service account key file. |
WIF (Client Credentials) | Note: Data Ingestion and Replication can't use the WIF (Client Credentials) authentication type. |
Property | Description |
|---|---|
Service Account Email | The client_email value from the Google service account key JSON file. |
Service Account Key | The private_key value from the Google service account key JSON file. Enter the entire block of text within the double quotation marks in the private_key field. Start with -----BEGIN PRIVATE KEY-----\n and end with -----END PRIVATE KEY-----\n. |
Project ID | The project_id value from the Google service account key JSON file. If you created multiple projects with the same service account, enter the ID of the project that contains the bucket. |
Optimize Object Metadata Import | Imports metadata for the selected object without parsing other objects, folders, or subfolders in the bucket. Importing only the selected object reduces the time that the connector spends parsing the bucket. Default is not selected. This property does not apply to a file ingestion and replication task. |
Property | Description |
|---|---|
Service Account Private Key ID | This property is not applicable for Google Cloud Storage V2 Connector. The private_key_id value from the Google service account key JSON file. This property applies only to a database ingestion and replication or streaming ingestion and replication task. |
Service Account Client ID | This property is not applicable for Google Cloud Storage V2 Connector. The client_id value from the Google service account key JSON file. This property applies only to a database ingestion and replication or streaming ingestion and replication task. |
Is Encrypted File | Specifies whether a file is encrypted. Select this option when you import an encrypted file from Google Cloud Storage. Default is not selected. This property applies only to mappings in advanced mode. |
Bucket Name | The name of the Google Cloud Storage bucket that you want to connect to. When you select a source object or target object in a mapping, the Package Explorer lists files and folders available in the specified Google Cloud Storage bucket. If you don't specify a bucket name, you can select a bucket from the Package Explorer to select a source or target object. |
Property | Description |
|---|---|
Project Number | The unique numeric identifier of the Google Cloud project that contains the Workload Identity Pool. |
Access Token URL | The identity provider endpoint that issues access tokens. Enter an HTTPS URL. For Microsoft Entra ID, use the following syntax: https://login.microsoftonline.com/<tenant ID>/oauth2/v2.0/token |
Client ID | The unique identifier that the identity provider assigns to your application. The identity provider uses this ID to identify the requester during authentication and authorization. |
Client Secret | The confidential key that the identity provider issues with the client ID. The key acts as a password and proves the authenticity of the client during token exchanges. |
Pool ID | The ID of the Workload Identity Pool in Google Cloud Platform that aggregates trusted external identities. Enter the pool ID, not the full resource path. |
Provider ID | The ID of the external identity provider that you configured in the Workload Identity Pool. Enter the provider ID, not the full resource path. |
Scope | The OAuth scope that the connector requests when it exchanges credentials for an access token. Use one of the following formats:
For example, api://<client ID>/.default For example, https://www.googleapis.com/auth/devstorage.read_write Enter a scope. The property has no default value. |
Access Token | The access token that Google Cloud Platform issues to access Google Cloud Storage resources. Click Generate Token to generate a new access token. |
Optimize Object Metadata Import | Imports metadata for the selected object without parsing other objects, folders, or subfolders in the bucket. Importing only the selected object reduces the time that the connector spends parsing the bucket. Default is not selected. |
Property | Description |
|---|---|
Enable Service Account Impersonation | Determines whether to impersonate a Google service account to access Google Cloud Storage resources. When you select this option, the connector exchanges the federated token for a short-lived access token of the target service account. The Target Service Account Email property appears. Default is not selected. |
Target Service Account Email | The email address of the Google service account to impersonate. The connector uses the permissions of this account to access Google Cloud Storage resources. Required when you select the Enable Service Account Impersonation property. Use the following syntax: <service account name>@<project ID>.iam.gserviceaccount.com |
Use Data Project | Specifies whether to access Google Cloud Storage resources in a project other than the Workload Identity Pool project. When you select this option, the Data Project ID property appears. If you clear this option, the connector uses the Cloud Resource Manager endpoint to resolve the project from the pool. Default is not selected. |
Data Project ID | The ID of the Google Cloud project that contains your Google Cloud Storage resources. Required when you select the Use Data Project property. |
Is Encrypted File | Specifies whether a file is encrypted. Select this option when you import an encrypted file from Google Cloud Storage. Default is not selected. |
Bucket Name | The name of the Google Cloud Storage bucket that you want to connect to. When you select a source or target object in a mapping, the Package Explorer lists the files and folders in the specified bucket. If you don't specify a bucket name, select a bucket in the Package Explorer when you choose a source or target object. |