Workiva Support Center

With the Google® Cloud Storage connector, you can use commands in a chain to manage files and folders in Google Cloud Storage buckets.

Note: This connector is built by Workiva and connects to a third-party system. While our Support team can help configure this connector within your workspace, we are unable to troubleshoot or otherwise assist with any issues that originate outside of the Workiva platform.

Prerequisites

To enable the connection, the connector uses the Google Cloud Storage JSON API. To set up the connector, you'll need:

• A dedicated Google Cloud application for the connector
• The default Google Cloud Storage bucket to interact with

To secure the connection, the application can use OAuth consent or Application Default Credentials (ADC) for authentication. Depending on the authentication method, you'll also need:

• If OAuth consent, the application's client ID and secret

• If ADC with a CloudRunner, a dedicated service account for the application and its application_default_credentials.json credentials file

  Note: If ADC with a GroundRunner on Google Compute Engine, Google Kubernetes Engine (GKE), App Engine, Cloud Run, or Cloud Functions, the connector can authenticate via the app's default service account.

Note: To make the connector available for use in your organization's chains, an org security administrator first enables it from Configuration.

Create a Google Cloud application

To set up the connector, first create a dedicated Google Cloud application for the connector. To connect to its application, the connector uses Google Cloud ADC or OAuth consent.

Step 1. Select or create a project

In the Google Cloud Platform (GCP) console, select or create a project to use with the connector. To create a project:

1. In the toolbar, click Select a project or the current project's name, and then click New Project.
   
2. In Project name, enter a unique name to help identify the integration.
3. In Location, select your organization so others can use the project.
4. Click Create.
    

Step 2. Enable service access

1. From APIs & Services, select Library.
   
2. Search for and select Cloud Storage, and click Enable.
    

Step 3. Create or retrieve the app's authentication credentials

To authenticate the application, create and retrieve its credentials for Google Cloud ADC or OAuth consent.

Google Cloud application default credentials (ADC)

If the application runs on a Google Cloud environment such as Compute Engine, Kubernetes Engine, App Engine, Cloud Run, or Cloud Functions, you can use its default service account for authentication. Otherwise, create a service account and download its credentials file for authentication:

1. In the Google Cloud Platform (GCP) console, open Create service account key.
   
2. In Service account, select New service account.
3. Enter a unique name to help identify the service account.
4. In Role, select Cloud Storage, Storage Object Admin.
5. Under Key type, select JSON.
6. Click Create. The service account's application_default_credentials.json file downloads. When you set up the connector, you'll upload this file as a resource.
    

OAuth consent

To authenticate the application using OAuth consent:

1. From APIs & Services, select OAuth consent screen.
2. On the OAuth consent screen tab, select Internal, and click Create.
   
3. Under App information, enter the application's name and user support email address to help identify the app when authenticating the connector.
4. Under App domain, add an authorized domain of wdesk.com.
   
5. Under Developer contact information, enter the email address Google should send any updates regarding the project, and click Save and Continue.

6. Under Scopes and Optional info, click Save and Continue without adding any scopes or optional information.

   Note: No scopes or optional information are required for an application with internal users.

7. Under Summary, review and edit the OAuth consent screen details as necessary, and click Back to Dashboard.
8. On the Credentials tab, click Create credentials, and select OAuth client ID.
   
9. Under Application type, select Web application.
   
10. Enter a unique name to help identify the OAuth credentials.
11. Under Authorized JavaScript origins:
    • For the USA, Central America, and South America, enter https://h.app.wdesk.com.
    • For APAC, enter https://h.apac.wdesk.com.
    • For Canada, enter https://h.ca.wdesk.com.
    • For EMEA, enter https://h.eu.wdesk.com.
12. Under Authorized redirect URIs:
    • For the USA, Central America, and South America, enter https://h.app.wdesk.com/s/wdata/oc/app/oauth/callback.
    • For APAC, enter https://h.apac.wdesk.com/s/wdata/oc/app/oauth/callback.
    • For Canada, enter https://h.ca.wdesk.com/s/wdata/oc/app/oauth/callback.
    • For EMEA, enter https://h.eu.wdesk.com/s/wdata/oc/app/oauth/callback.
13. Click Create, and note the client ID and secret.

Set up the Google Cloud Storage connector with application default credentials

1. In Chain Builder, click compare_arrows  Connections in the left sidebar, and then Create compare_arrows at the top right.
2. Under Connector Connection, select Google Cloud Storage and the runner to use with the connector.
   
3. Under Basic Info, enter a unique name and description to help identify the connector.
4. In Authentication Type, select Standard.

5. To authenticate with the application's credentials file: 

   • Under Resources, upload the credentials file for the connector's Google web application.
   • Under Authentication, enter the name of the credentials file, such as application_default_credentials.json.

   Note: To authenticate using a default service account, leave Resources and Authentication blank.

6. Under Properties, enter the default Cloud Storage bucket to use with the connector if not specified by a command.
7. Select the environments to use with the connection, and click Save.
8. To test the connection, create and run a chain with the connector's List Objects command, and verify it returns a valid output.

Set up the Google Cloud Storage connector with OAuth consent

1. In Chain Builder, click compare_arrows  Connections in the left sidebar, and then Create compare_arrows at the top right.
2. Under Connector Connection, select Google Cloud Storage and the default CloudRunner.
   
3. Under Basic Info, enter a unique name and description to help identify the connector.
4. In Authentication Type, select OAuth 2.0.

5. Under OAuth, enter the client ID and secret for the connector's Google web application.

   Note: All sensitive credentials are automatically encrypted and stored at Advanced Encryption Standard (AES)-256 encryption.

6. Click Connect, and authorize the connector's access to your Google account.

   Note: To ensure Google can authorize the connector's access, enable browser pop-ups.

7. Under Properties, enter the default Cloud Storage bucket to use with the connector if not specified by a command.
8. Select the environments to use with the connection, and click Save.
9. To test the connection, create and run a chain with the connector's List Objects command, and verify it returns a valid output.

Troubleshooting

If the connection to Google Cloud Storage fails:

• Verify the Google web application's credentials file or OAuth credentials.
• Verify the application's authorized JavaScript origin:
  • For the USA, Central America, and South America, https://h.app.wdesk.com.
  • For APAC, https://h.apac.wdesk.com.
  • For Canada, https://h.ca.wdesk.com.
  • For EMEA, https://h.eu.wdesk.com.
• Ensure the application's redirect URI:
  • For the USA, Central America, and South America, https://h.app.wdesk.com/s/wdata/oc/app/oauth/callback.
  • For APAC, https://h.apac.wdesk.com/s/wdata/oc/app/oauth/callback.
  • For Canada, https://h.ca.wdesk.com/s/wdata/oc/app/oauth/callback.
  • For EMEA, https://h.eu.wdesk.com/s/wdata/oc/app/oauth/callback.
• Verify the web application has access to the Google Cloud Storage API enabled.