> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hightouch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud Platform

> Grant Hightouch access to resources within your Google Cloud project.

## Overview

Hightouch's Google Cloud integration powers several features:

* Workspace deployment on Google Cloud (see [Regions](https://docs.hightouch.com/security/regions.md#supported-regions))
* [Self-hosted storage via GCS](https://docs.hightouch.com/security/storage.md#self-hosted-storage)
* [BigQuery](https://docs.hightouch.com/sources/google-bigquery.md) source
* [Google Cloud Storage](https://docs.hightouch.com/sources/gcs.md) source
* [Google Cloud Storage](https://docs.hightouch.com/destinations/gcs.md) destination
* [Google Private Service Connect](https://docs.hightouch.com/security/gcp/private-service-connect.md)

## Setup

To give Hightouch access to resources on your GCP account,
go to the [**Cloud providers**](https://app.hightouch.com/settings/cloud-providers?from=docs) tab on the Settings page.
Click **Add cloud provider**, and select **Google Cloud Platform**.

![Adding a new cloud provider in Hightouch](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/integrations/cloud-providers/add-new-credential.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=0c60f0fd564c5dc0747f01e0deaa5077)

Give your credential a **Display name**, then select either **Service account managed by Hightouch** or **Bring your own service account**.

### Managed service account

When using the managed service account access type, Hightouch creates a service account within our secure Google Cloud account, to which you can bind your project's IAM policies. IAM policies grant permissions within your Google Cloud project.

When you click **Create a new service account**, Hightouch generates a new service account in our project. The service account is unique to your workspace and this credential. You can then copy the service account email and click **Create** to confirm the service account creation.

![Using a managed service acount](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/integrations/gcp/managed-1-create.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=96ec57511dc8cd53444798cf25f6d905)

Next, you need to bind IAM roles to this service account by calling [`gcloud projects add-iam-policy-binding`](https://cloud.google.com/sdk/gcloud/reference/projects/add-iam-policy-binding) via the Google Cloud CLI. The specific roles you grant depend on the types of resources you want to grant Hightouch access to, such as [Cloud Storage](https://docs.hightouch.com/security/storage.md) or [BigQuery](https://docs.hightouch.com/sources/google-bigquery.md). Consult the relevant docs for more information on the specific permissions Hightouch needs.

### Bring your own service account

When you **Bring your own service account** you upload your service account's key, which Hightouch securely stores.

First, you need to [create a service account](https://cloud.google.com/iam/docs/creating-managing-service-accounts), [grant it the relevant roles](https://cloud.google.com/iam/docs/granting-changing-revoking-access), and [generate a key](https://cloud.google.com/iam/docs/creating-managing-service-account-keys). Make sure you create **JSON** key, not P12. Once the service account and key have been created, download the key to your machine and drag and drop it into the file selector.

Hightouch then parses the key, and if it's valid, you see the **Client ID** and **Client Email** fields populated. If those correspond with your intended service account, click **Create**.

![Bring your own service acount](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/integrations/gcp/byo-1-create.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=394f65b3a367688304a6abdf604c7f50)

Make sure the service account you attached has the specific roles you need.
These permissions depend on the types of resources you want to grant Hightouch access to, such as [Cloud Storage](https://docs.hightouch.com/security/storage.md) or [BigQuery](https://docs.hightouch.com/sources/google-bigquery.md).
Consult the relevant docs for more information on the specific permissions Hightouch needs.

## Google Cloud credential usage

Once you've set up your Google Cloud credentials in Hightouch, you can now use them throughout the app, for example for [external storage](https://docs.hightouch.com/security/storage.md), the [BigQuery](https://docs.hightouch.com/sources/google-bigquery.md) and [GCS](https://docs.hightouch.com/sources/gcs.md) sources, and other Google Cloud integrations like [Google Ad Manager](https://docs.hightouch.com/destinations/gam360.md).

> [!TIP]
>
> Regardless of whether you use a managed service account or being your own,
> ensure it has required permissions. Consult the relevant docs for more
> information on the specific permissions Hightouch needs.