---
url: https://docs.realmsec.info/integration/gcs.md
---

# Google Cloud Integration

## Configuring Google Cloud Storage as Destination

Realm Security supports integration with Google Cloud Storage as a destination. This guide provides instructions for configuring Google Cloud Storage to receive data from Realm.

## Step 1: Create GCS Bucket

1. Login to the GCS console.
2. Navigate to **Cloud Storage > Buckets > Create Bucket**.

![Buckets](../images/gcs_buckets.jpg)

3. Enter a name for the bucket, for example: `Realm-Archive`.
4. Select **Standard** storage.
5. Click **Create**.

![Create Bucket](../images/gcs_create_bucket.jpg)

6. Review the bucket configuration.

![Bucket Config](../images/gcs_bucket_config.jpg)

## Step 2: Create a Service Account

**Note**: Realm does not support the legacy P12 secret, please ensure you are creating a JSON GCP Service Account Key.

1. Go to **IAM > Service Accounts**.
2. Click **Create Service Account**.

![Create Service Account](../images/gcs_create_service_account.jpg)

3. Enter a name for the service account:
   > **Name:** `realm-archive-account`
4. Click **Create and Continue**.
5. Grant permission to write to the bucket:
   * **Add role > Cloud Storage > Storage Object Creator**

![Service Account Role](../images/gcs_service_account_permission.jpg)

6. Add an IAM condition to restrict access to just one bucket:

```text
resource.service == "storage.googleapis.com" &&
resource.name.startsWith("projects/_/buckets/REPLACE_WITH_BUCKET_NAME")
```

7. Select the service account.

![Select Service Account](../images/gcs_service_account.jpg)

8. Go to **Keys > Create Key > JSON**.

![Create Service Account Key](../images/gcs_service_account_key.jpg)

9. Click **Create**. The service account key will be downloaded to your local machine. Open the key in a text editor, select all contents, and copy to clipboard.

## Step 3: Create a Destination in Realm for GCS Archive

1. Navigate to **Destinations > Add Destination**.
   > **Name:** `Archive`
   > **Type:** `Data Lake`
2. Under **Destinations**, select **Add New Source**.
   * Connect the relevant log source (e.g., FortiGate, Azure, etc.) to the destination.
3. Go to **Output Feeds > Add Output Feed**.
   * Choose **GCS** output feed.
   > **Name:** `GCS Archive`
   > **Bucket Name:** Enter the name of the bucket created above
   > **Service Account Key:** Paste the service account key copied earlier

![GCS Output feed](../images/gcs_output_feed.jpg)

## Related Resources

* [Setup GCS Service Account Key](https://cloud.google.com/iam/docs/service-account-overview)
* [Setup GCS Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation)