---
title: Enabling GitHub Actions with Google Cloud Storage
intro: 'You can enable {% data variables.product.prodname_actions %} on {% data variables.product.prodname_ghe_server %} and use Google Cloud Storage to store data generated by workflow runs.'
permissions: 'Site administrators can enable {% data variables.product.prodname_actions %} and configure enterprise settings.'
versions:
  feature: actions-ghes-gcp-storage
type: how_to
topics:
  - Actions
  - Enterprise
  - Infrastructure
  - Storage
shortTitle: Google Cloud Storage
---

{% note %}

**Note:** {% data variables.product.prodname_actions %} support for Google Cloud Storage is currently in beta and subject to change.

{% endnote %}

{% data reusables.actions.enterprise-storage-about %}

{% ifversion ghes-actions-storage-oidc %}
{% data reusables.actions.enterprise-storage-about-oidc %}

{% data reusables.actions.ghes-storage-oidc-beta-note %}
{% endif %}

## Prerequisites

Before enabling {% data variables.product.prodname_actions %}, make sure you have completed the following steps:

* Create your Google Cloud Storage bucket for storing data generated by workflow runs.
{% data reusables.actions.enterprise-common-prereqs %}
{% data reusables.actions.enterprise-oidc-prereqs %}

{% ifversion ghes-actions-storage-oidc %}
## Enabling {% data variables.product.prodname_actions %} with Google Cloud Storage using OIDC (recommended)

{% data reusables.actions.ghes-storage-oidc-beta-note %}

To configure {% data variables.product.prodname_ghe_server %} to use OIDC with Google Cloud Storage, you must first create a Google Cloud service account, then create a Google Cloud identity pool and identity provider, and finally configure {% data variables.product.prodname_ghe_server %} to use the provider and service account to access your Google Cloud Storage bucket.

### 1. Create a service account

1. Create a service account that can access your bucket using OIDC. For more information, see [Creating and managing service accounts](https://cloud.google.com/iam/docs/creating-managing-service-accounts) in the Google Cloud documentation.

   When creating the service account, ensure that you do the following:

   * Enable the IAM API as described at the start of [Creating and managing service accounts](https://cloud.google.com/iam/docs/creating-managing-service-accounts).
   * Add the following roles to the service account:
     * Service Account Token Creator
     * Storage Object Admin
1. After creating the service account, note its email address, as it is need later. The service account email address is in the format `SERVICE-ACCOUNT-NAME@PROJECT-NAME.iam.gserviceaccount.com`.

### 2. Create an identity pool and identity provider

1. In the Google Cloud console, go to the [New workload provider and pool](https://console.cloud.google.com/iam-admin/workload-identity-pools/create) page.
1. Under "Create an identity pool", enter a name for the identity pool, and click **Continue**.
1. Under "Add a provider to pool":

   - For "Select a provider", select **OpenID Connect (OIDC)**.
   - For "Provider name", enter a name for the provider.
   - For "Issuer (URL)", enter the following URL, replacing `HOSTNAME` with the public hostname for {% data variables.location.product_location_enterprise %}:

      ```
      https://HOSTNAME/_services/token
      ```

      For example:

      ```
      https://my-ghes-host.example.com/_services/token
      ```
    - Under "Audiences", leave **Default audience** selected, but note the identity provider URL, as it is needed later. The identity provider URL is in the format `https://iam.googleapis.com/projects/PROJECT-NUMBER/locations/global/workloadIdentityPools/POOL-NAME/providers/PROVIDER-NAME`.
    - Click **Continue**.
1. Under "Configure provider attributes":

   - For the "OIDC 1" mapping, enter `assertion.sub`.
   - Under "Attribute Conditions", click **Add condition**.
   - For "Condition CEL", enter the following condition, replacing `HOSTNAME` with the public hostname for {% data variables.location.product_location_enterprise %}:

      ```
      google.subject == "HOSTNAME"
      ```

      For example:

      ```
      google.subject == "my-ghes-host.example.com"
      ```

      {% note %}

      **Note:** The hostname of {% data variables.location.product_location_enterprise %} used here _must not_ include the protocol.

      {% endnote %}
   - Click **Save**.
1. After creating the identity pool, at the top of the identity pool's page, click **Grant access**.
   - Under "Select service account", select the service account that you created in the previous procedure.
   - Under "Select principals (identities that can access the service account)", select **Only identities matching the filter**.
   - For "Attribute name", select **subject**.
   - For "Attribute value", enter your {% data variables.product.prodname_ghe_server %} hostname, without the protocol. For example, `my-ghes-host.example.com`.
   - Click **Save**.
   - You can dismiss the "Configure your application" dialog, as the configuration file is not needed.

### 3. Configure {% data variables.product.prodname_ghe_server %} to connect to Google Cloud Storage using OIDC

{% data reusables.enterprise_site_admin_settings.access-settings %}
{% data reusables.enterprise_site_admin_settings.management-console %}
{% data reusables.enterprise_management_console.actions %}
{% data reusables.actions.enterprise-enable-checkbox %}
{% data reusables.actions.enterprise-gcp-storage-setup %}
1. Under "Authentication", select **OpenID Connect (OIDC)**, and enter the values for your storage:
   * **Service URL**: The service URL for your bucket. This is usually `https://storage.googleapis.com`.
   * **Bucket name**: The name of your bucket.
   * **Workload Identity Provider ID**: The identity provider ID for your identity pool.

     This is in the format `projects/PROJECT-NUMBER/locations/global/workloadIdentityPools/POOL-NAME/providers/PROVIDER-NAME`. Note that you must remove the `https://iam.googleapis.com/` prefix from the value noted in the previous procedure.

     For example, `projects/1234567890/locations/global/workloadIdentityPools/my-pool/providers/my-provider`.
   * **Service account**: The service account email address that you noted in the previous procedure. For example, `ghes-oidc-service-account@my-project.iam.gserviceaccount.com`.
{% data reusables.enterprise_management_console.test-storage-button %}
{% data reusables.enterprise_management_console.save-settings %}

{% endif %}

## Enabling {% data variables.product.prodname_actions %} with Google Cloud Storage{% ifversion ghes-actions-storage-oidc %} using a HMAC key{% endif %}

1. Create a Google Cloud service account that can access the bucket, and create a Hash-based Message Authentication Code (HMAC) key for the service account. For more information, see "[Manage HMAC keys for service accounts](https://cloud.google.com/storage/docs/authentication/managing-hmackeys)" in the Google Cloud documentation.

   The service account must have the following [Identity and Access Management (IAM) permissions](https://cloud.google.com/storage/docs/access-control/iam-permissions) for the bucket:

   * `storage.objects.create`
   * `storage.objects.get`
   * `storage.objects.list`
   * `storage.objects.update`
   * `storage.objects.delete`
   * `storage.multipartUploads.create`
   * `storage.multipartUploads.abort`
   * `storage.multipartUploads.listParts`
   * `storage.multipartUploads.list`
{% data reusables.enterprise_site_admin_settings.access-settings %}
{% data reusables.enterprise_site_admin_settings.management-console %}
{% data reusables.enterprise_management_console.actions %}
{% data reusables.actions.enterprise-enable-checkbox %}
{%- ifversion ghes-actions-storage-oidc %}
{% data reusables.actions.enterprise-gcp-storage-setup %}
1. Under "Authentication", select **Credentials-based**, and enter your storage bucket's details:

{% indented_data_reference reusables.actions.enterprise-gcp-storage-credential-fields spaces=3 %}
{%- else %}
1. Under "Artifact & Log Storage", select **Google Cloud Storage**, and enter your bucket's details:

{% indented_data_reference reusables.actions.enterprise-gcp-storage-credential-fields spaces=3 %}
{%- endif %}
{% data reusables.enterprise_management_console.test-storage-button %}
{% data reusables.enterprise_management_console.save-settings %}

{% data reusables.actions.enterprise-postinstall-nextsteps %}