> For the complete documentation index, see [llms.txt](https://docs.upriverdata.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.upriverdata.com/integrations/gcp.md).

# GCP

Upriver connects to Google Cloud through a **read-only service account that lives in your own project**. You create it by downloading a Terraform file from the connector card in Upriver and running it yourself — the file is pre-filled from the answers you give in the UI, so there is nothing to request from an Upriver representative and nothing to send back by email.

Two GCP services connect this way, each with its own guide:

| Service                                                   | What Upriver does with it                                                                                             |
| --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| [**BigQuery**](/integrations/gcp/bigquery.md)             | Monitors datasets and tables for data quality, builds lineage, and lets the agent run read-only queries during triage |
| [**Cloud Composer**](/integrations/gcp/cloud-composer.md) | Reads DAGs, run history, task logs and import errors, so incidents can be traced to the pipeline that caused them     |

**One run can cover both.** Each connector's first step has a checkbox to also connect the other service in the same Terraform run, so your security team reviews one change instead of two. BigQuery and Composer may live in different projects — you list every project Upriver should read from during setup.

***

## How access works

1. The Terraform you run creates a **dedicated service account in your project**, owned by you, and grants it read-only roles on the projects (and, if you choose, the specific datasets and tables) you named.
2. It grants Upriver's platform service account `roles/iam.serviceAccountTokenCreator` **on that one service account**. Upriver then authenticates by impersonating it with short-lived tokens.
3. **There is no service account key** — none is created, and the product has no key upload path. There is no long-lived credential to leak or rotate.
4. Revoking is entirely on your side: remove that one binding, or run `terraform destroy`.

The complete role list — every role, where it is granted and what it is used for, including an honest note on the audit-log access that lineage depends on — is in [BigQuery Permissions](/integrations/gcp/bigquery/bigquery-permissions.md). It is written to be diffed against your `terraform plan` output.

***

## Google Cloud Storage

The self-serve setup above covers BigQuery and Cloud Composer only — **it grants no Cloud Storage roles**. Monitoring data in GCS buckets uses the same read-only service account, but the access to the buckets is arranged with your Upriver representative. Once that is in place, buckets are configured per data source, as described on the [Google Cloud Storage (GCS)](/integrations/gcp/google-cloud-storage-gcs.md) page.

<details>

<summary>Enabling access management on a GCS folder</summary>

To scope Upriver to specific folders inside a bucket rather than the whole bucket, the folder has to be a **managed folder**. How to enable that from the Cloud Console:

{% embed url="<https://app.arcade.software/share/3NDI0XZreywhP50AXWFA>" %}

</details>

***

## Hybrid deployments

In a hybrid deployment Upriver runs the monitoring from a Databricks workspace created inside one of your projects, rather than from Upriver's SaaS. That model needs permissions well beyond the read-only setup above — including the ability to create service accounts, buckets and compute in a project dedicated to Upriver — so it is planned together with your Upriver representative rather than self-served. The read-only data viewer service account is created the same way; only the impersonation path differs, since Upriver can then impersonate it solely from the workspace in your project.