Cloud Storage from Cloud Shell: your first bucket, set up safely

Cloud Storage, in plain words

Cloud Storage is Google Cloud's object store. You put files of any type (called objects) into containers called buckets, and read them back over an API, the gcloud storage command or the console. An object can't be edited in place: to change it you upload a new version that replaces the old one.

Each bucket has a few settings that are hard or impossible to change later: its name, which shares one global namespace with every other Cloud Storage user, and its location, such as the single region us-central1 or the multi-region us. Other settings you can adjust: the default storage class (Standard, Nearline, Coldline or Archive, trading cheaper storage for minimum storage periods and retrieval fees), uniform bucket-level access so permissions come only from IAM, public access prevention, and soft delete, which keeps deleted objects recoverable for a while.

News from the last two weeks: on October 13, 2026 Google added a Preview called object enrichments, which runs pre-trained models over eligible images and PDFs in chosen buckets and attaches the results to each object as object contexts you can then analyze in BigQuery.

The AI angle

Most AI work on Google Cloud starts in a bucket: training and tuning datasets, batch prediction input and output files, and the documents you index for retrieval usually live at gs:// paths that Gemini Enterprise Agent Platform (formerly Vertex AI) and BigQuery can read. The new object enrichments Preview goes a step further by labelling images and classifying PDFs inside the bucket itself, so you can search a large media library by what it contains. That Preview has its own inference charges, so it is not part of today's free lab.

Hands-on lab: Create a private bucket, upload, read and delete it

Make a Standard bucket in a free-tier region with safe settings, check those settings, upload two small files, read them back, then delete everything and confirm nothing is left.

1. Open Cloud Shell and set variables

   Choose Activate Cloud Shell in the console's top bar. The bucket name below is random so it is unique worldwide and reveals nothing about you; bucket names are public. Write the printed name down in case Cloud Shell reconnects and forgets the variable.

   gcloud config set project YOUR_PROJECT_ID
   REGION=us-central1
   BUCKET="lab-$(date +%s)-$RANDOM"
   echo "My lab bucket: $BUCKET"
   gcloud services enable storage.googleapis.com

   Done

2. Create the bucket with safe settings

   Pick the region explicitly: without --location you get the multi-region us, which is outside the free tier and can't be changed later. --uniform-bucket-level-access means only IAM controls access, --public-access-prevention blocks any public sharing, and --soft-delete-duration=0 turns off soft delete so cleanup really removes the data. Keep soft delete on for real data.

   gcloud storage buckets create gs://$BUCKET \
     --location=$REGION \
     --default-storage-class=STANDARD \
     --uniform-bucket-level-access \
     --public-access-prevention \
     --soft-delete-duration=0

   Done

3. Check what you created

   --raw shows the bucket the way the API returns it. Look for location US-CENTRAL1, storage class STANDARD, publicAccessPrevention: enforced, uniform bucket-level access enabled, and a soft delete retention of 0 seconds.

   gcloud storage buckets describe gs://$BUCKET --raw \
     --format="yaml(location,storageClass,iamConfiguration,softDeletePolicy)"

   Done

4. Upload two small objects

   The first upload copies a local file. The second streams text straight from a pipe; - as the source means standard input. The notes/ part is just a prefix in the object's name, which the console shows as a folder.

   echo "Hello from my sandbox bucket" > hello.txt
   gcloud storage cp hello.txt gs://$BUCKET/notes/hello.txt
   echo "Streamed without a local file" | gcloud storage cp - gs://$BUCKET/notes/piped.txt

   Done

5. List, read and inspect

   ls -l shows each object's size, creation time and URL. cat prints an object without downloading it to disk. objects describe shows its metadata, including content type, storage class and checksums.

   gcloud storage ls -l gs://$BUCKET/notes/
   gcloud storage cat gs://$BUCKET/notes/hello.txt
   gcloud storage objects describe gs://$BUCKET/notes/hello.txt

   Done

gcloud storage rm --recursive gs://$BUCKET
rm -f hello.txt
# confirm nothing is left
gcloud storage ls
gcloud storage buckets describe gs://$BUCKET || echo "Bucket is gone"
# optional, practice-only project:
# gcloud projects delete YOUR_PROJECT_ID

Gotchas

• Leaving out --location creates the bucket in the multi-region us, which the free tier doesn't cover, and a bucket's location can't be changed afterwards.
• Soft delete is on by default with a 7-day window, and soft-deleted objects keep incurring storage charges until it ends. That protects real data, but surprises people who delete large test files and still see a bill.
• Bucket names are global and publicly visible, and a deleted bucket's name can be claimed by someone else. Keep project IDs, emails and other personal details out of them.
• Nearline, Coldline and Archive have minimum storage periods (30, 90 and 365 days) and retrieval fees. Deleting or rewriting an object early still bills the minimum, so test with Standard.
• In a regular (flat) bucket, folders are only name prefixes. Renaming a 'folder' copies and deletes every object under it, which costs operations and time on big buckets.