Create a Google Cloud Storage V2 connection to securely read data from or write data to Google Cloud Storage files.
Prerequisites for Service Account authentication
Before you configure a Google Cloud Storage V2 connection to use Service Account authentication, complete the following prerequisite tasks.
1Ensure that you have a Google service account to access Google Cloud Storage.
2Ensure that you have the client email, project ID, and private key values for the service account. Enter these details when you create a Google Cloud Storage V2 connection.
3Enable the Google Cloud Storage JSON API for your service account. Google Cloud Storage V2 Connector uses the Google API to integrate with Google Cloud Storage.
4Verify that you have read and write access to the Google Cloud Storage bucket that contains the source and target files.
5To run a mapping that reads data from or writes data to a Google Cloud Storage file, ensure that you have the required permissions.
6To use the Informatica encryption method, complete the following tasks:
- Enable the Informatica crypto library license in Administrator.
- Add the following firewall rules to the Virtual Private Cloud (VPC) network on the Google Cloud Platform advanced cluster:
▪ List of Secure Agent IP address ranges in the Source Filter section.
▪ Google Cloud Platform cluster IP address ranges in the Source Filter section.
▪ Ports from 0 through 65535 and udp:443 in the Protocols and Ports section.
- Ensure that the VPC network tag on the Secure Agent virtual machine matches the source tag and target tag of the firewall rules.
Connect to Google Cloud Storage V2
Let's configure the Google Cloud Storage V2 connection properties to connect to Google Cloud Storage.
Connection details
The following table describes the Google Cloud Storage V2 connection properties:
Property
Description
Connection Name
Name of the connection.
Each connection name must be unique within the organization. Connection names can contain alphanumeric characters, spaces, and the following special characters: _ . + -,
Maximum length is 255 characters.
Description
Description of the connection. Maximum length is 4000 characters.
Use Secret Vault
Stores sensitive credentials for this connection in the secrets manager that is configured for your organization.
This property appears only if secrets manager is set up for your organization.
This property is not supported by Data Ingestion and Replication and the Data Access Management services.
When you enable the secret vault in the connection, you can select the credentials that the Secure Agent retrieves from the secrets manager. If you don't enable this option, the credentials are stored in the repository or on a local Secure Agent, depending on how your organization is configured.
Note:
If you’re using this connection to apply data access policies through pushdown or proxy services, you cannot use the Secret Vault configuration option.
For information about how to configure and use a secrets manager, see "Secrets manager configuration" in the Administrator help.
Runtime Environment
The name of the runtime environment where you want to run tasks.
For application ingestion and replication tasks and database ingestion and replication tasks, you can use the Secure Agent or serverless runtime environment. The tasks must have a source type supported for serverless use. For file ingestion and replication tasks and streaming ingestion and replication tasks, you can use only the Secure Agent. You cannot run tasks on a Hosted Agent or elastic runtime environment.
For more information about runtime environments, see Runtime Environments in the Administrator help.
Authentication types
You can connect to Google Cloud Storage with a service account key.
The following table describes the authentication types that you can select in the connection:
Authentication Type
Description
Service Account
Authenticate with the credentials in a Google service account key file.
WIF (Client Credentials)
Note:
Data Ingestion and Replication can't use the WIF (Client Credentials) authentication type.
The default is Service Account.
After you select an authentication type, configure the properties for that type.
Service Account authentication
Configure the basic and advanced connection properties for Service Account authentication to Google Cloud Storage.
Service Account authentication requires a service account email, a service account key, and a project ID.
The following table describes the basic connection properties for Service Account authentication:
Property
Description
Service Account Email
The client_email value from the Google service account key JSON file.
Service Account Key
The private_key value from the Google service account key JSON file.
Enter the entire block of text within the double quotation marks in the private_key field.
Start with -----BEGIN PRIVATE KEY-----\n and end with -----END PRIVATE KEY-----\n.
Project ID
The project_id value from the Google service account key JSON file.
If you created multiple projects with the same service account, enter the ID of the project that contains the bucket.
Optimize Object Metadata Import
Imports metadata for the selected object without parsing other objects, folders, or subfolders in the bucket.
Importing only the selected object reduces the time that the connector spends parsing the bucket.
Default is not selected.
This property does not apply to a file ingestion and replication task.
Advanced settings
The following table describes the advanced connection properties for Service Account authentication:
Property
Description
Service Account Private Key ID
The private_key_id value from the Google service account key JSON file.
This property applies only to a database ingestion and replication or streaming ingestion and replication task.
Service Account Client ID
The client_id value from the Google service account key JSON file.
This property applies only to a database ingestion and replication or streaming ingestion and replication task.
Is Encrypted File
Specifies whether a file is encrypted. Select this option when you import an encrypted file from Google Cloud Storage.
Default is not selected.
Bucket Name
The name of the Google Cloud Storage bucket that you want to connect to.
When you select a source object , the Package Explorer lists files and folders available in the specified Google Cloud Storage bucket.
If you don't specify a bucket name, you can select a bucket from the Package Explorer to select a source.
Proxy server settings
If your organization uses an outgoing proxy server to connect to the Internet, the Secure Agent connects to Informatica®Intelligent Data Management Cloud™ (IDMC) through the proxy server.
You can configure the Secure Agent to use the proxy server on Windows and Linux. You can connect to Google Cloud Storage through an authenticated or unauthenticated HTTP proxy server.
To configure the proxy settings for the Secure Agent, perform the following tasks:
•Configure the Secure Agent through the Secure Agent Manager on Windows or shell command on Linux.
For instructions, see "Configure the proxy settings on Windows" or "Configure the proxy settings on Linux" in Getting Started in the Data Integration help.
•Configure the JVM options for the DTM in the Secure Agent properties. For instructions, see the Proxy server settings Knowledge article.
Configure proxy settings for NTLM authentication
You can use a proxy server that uses NTLM authentication to connect to Google Cloud Storage.
To configure the proxy settings for NTLM authentication, perform the following steps:
1In Administrator, select Runtime Environments.
2Select the Secure Agent for which you want to configure from the list of available Secure Agents.
3In the upper-right corner, click Edit.
4In the System Configuration Details section, select the Type as DTM for the Data Integration Server.
5Edit the JVMOption1 and add the following value:
-Dhttp.auth.ntlm.domain=<domain name>
6Select the Type as Platform for the Data Integration Server.
7Edit the INFA_DEBUG property and add the following value: