This page describes how to attach and manage contexts on Cloud Storage objects in the form of key-value pairs.
Get the required roles
To get the permissions that you need to create and manage object contexts, ask your administrator to grant you the following IAM roles on the object:
-
Create objects with contexts:
Storage Object Creator (
roles/storage.objectCreator) -
Attach, update, view, and delete contexts from objects:
Storage Object User (
roles/storage.objectUser) -
View context keys and values attached to objects:
Storage Object Viewer (
roles/storage.objectViewer) -
Drop object contexts during rewrite, copy, and compose operations:
Storage Legacy Object Owner (
roles/storage.legacyObjectOwner)
For more information about granting roles, see Manage access to projects, folders, and organizations.
These predefined roles contain the permissions required to create and manage object contexts. To see the exact permissions that are required, expand the Required permissions section:
Required permissions
The following permissions are required to create and manage object contexts:
-
Create an object with object contexts:
-
storage.objects.create -
storage.objects.createContext
-
-
Attach, update, and delete object contexts:
-
storage.objects.update -
storage.objects.createContext -
storage.objects.updateContext -
storage.objects.deleteContext
-
-
Drop object contexts:
storage.objects.dropContexts -
View object contexts:
-
storage.objects.get -
storage.objects.list
-
You might also be able to get these permissions with custom roles or other predefined roles.
Attach contexts to new objects
Attach contexts to objects when you upload new objects to Cloud Storage buckets. Each context consists of a key and a value.
Command line
To attach contexts when you upload objects with the
gcloud storage cp command, use the --custom-contexts
flag:
gcloud storage cp OBJECT_LOCATION gs://DESTINATION_BUCKET_NAME --custom-contexts=KEY=VALUE,...
Where:
OBJECT_LOCATIONis the local path to your object. For example,Desktop/employees.txt.DESTINATION_BUCKET_NAMEis the name of the bucket to which you are uploading your object. For example,my-bucket.KEYis the context key to attach to an object. For example,Department. You can specify multiple key-value pairs separated by commas.VALUEis the value to associate with the context key. For example,Human resources.
Alternatively, create a JSON file that contains the contexts you want to
attach to the objects, and use the --custom-contexts-file flag:
{ "KEY": { "value": "VALUE" }, ... }
Where:
KEYis the context key to attach to an object. For example,Department. You can specify multiple key-value pairs.VALUEis the value to associate with the context key. For example,Human resources.
To attach contexts when you upload directories with the
gcloud storage rsync command, use the
--custom-contexts flag or the --custom-contexts-file flag:
gcloud storage rsync DIRECTORY_LOCATION gs://DESTINATION_BUCKET_NAME --recursive --custom-contexts=KEY=VALUE,...
Where:
DIRECTORY_LOCATIONis the local path to your directory. For example,~/my_directory.DESTINATION_BUCKET_NAMEis the name of the bucket to which you are uploading your directory. For example,my-bucket.KEYis the context key to attach to objects. For example,Department. You can specify multiple key-value pairs separated by commas.VALUEis the value to associate with the context key. For example,Human resources.
JSON API
To attach contexts to objects when you upload new objects, use any of the following methods:
As part of the object metadata in JSON format, include the contexts field:
{ "contexts": { "custom": { "KEY": { "value": "VALUE" }, ... } } }
Where:
KEYis the context key to attach to an object. For example,Department. You can specify multiple key-value pairs in thecustomobject.VALUEis the value to associate with the context key. For example,Human resources.
Attach or modify contexts to an existing object
You can attach new contexts to your existing objects in the Cloud Storage buckets.
Command line
Use the gcloud storage objects update command:
gcloud storage objects update gs://BUCKET_NAME/OBJECT_NAME CUSTOM_CONTEXTS_FLAG
Where:
BUCKET_NAMEis the name of the bucket that contains the object for which you want to edit context. For example,my-bucket.OBJECT_NAMEis the name of the object. For example,employees.txt.CUSTOM_CONTEXTS_FLAGis any of the following flags:To replace all existing contexts, use
--custom-contexts=KEY=VALUE,...or--custom-contexts-file=CUSTOM_CONTEXTS_FILEWhere:
KEYis the context key to attach to an object. For example,Department. You can specify multiple key-value pairs separated by commas.VALUEis the value to associate with the context key. For example,Human resources.CUSTOM_CONTEXTS_FILEis the path to the JSON or YAML file that contains the contexts you want to attach to the object.
To delete all existing contexts, use the
--clear-custom-contextsflag.To add, modify, or delete individual contexts, use a combination of
--update-custom-contexts=KEY=VALUE,...and--remove-custom-contexts=KEY,...Where:
KEYis the context key that you want to attach to or delete from an object. For example,Department.VALUEis the value to associate with the context key that you want to attach to or delete from an object. For example,Human resources.
If successful, the response looks like the following example:
Patching gs://my-bucket/employees.txt#1560574162144861... Completed 1
Client libraries
For more information, see the
Cloud Storage Java API
reference documentation.
To authenticate to Cloud Storage, set up Application Default Credentials.
For more information, see
Set up authentication for client libraries.
Before running code samples, set the Java
GOOGLE_CLOUD_UNIVERSE_DOMAIN environment
variable to s3nsapis.fr.
JSON API
Have gcloud CLI installed and initialized, which lets you generate an access token for the
Authorizationheader.Create a JSON file that contains the settings for the object, which must include the
contextsconfiguration fields for the object.To add, modify, or overwrite existing contexts, use the following format:
{ "contexts": { "custom": { "KEY": { "value": "VALUE" }, ... } } }
Where:
KEYis the context key to attach to an object. For example,Department. You can specify multiple key-value pairs in thecustomobject.VALUEis the value to associate with the context key. For example,Human resources.
To delete all existing contexts, use the following format:
{ "contexts": { "custom": null } }
To delete a specific key from the context, use the following format:
{ "contexts": { "custom": { "KEY": null, ... } } }
Where:
KEYis the context key that you want to delete from an object. For example,Department. You can specify multiple keys to delete from thecustomobject.Use
cURLto call the JSON API with aPATCHObject request:curl -X PATCH --data-binary @JSON_FILE_NAME \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json" \ "https://storage.s3nsapis.fr/storage/v1/b/BUCKET_NAME/o/OBJECT_NAME"
Where:
JSON_FILE_NAMEis the path to the file that includes the object contexts information.BUCKET_NAMEis the name of the bucket that contains the object for which you want to edit context. For example,my-bucket.OBJECT_NAMEis the URL-encoded name of the object. For example,employees.txt.
Alternatively, you can replace an object's context with a PUT
Object request. The PUT object request also replaces other
object metadata. Therefore, we don't recommend using the PUT
object request.
View object contexts
You can view an object's contexts by listing object metadata or describing a specific object.
Command line
Use the gcloud storage objects describe command:
gcloud storage objects describe gs://BUCKET_NAME/OBJECT_NAME
Where:
BUCKET_NAMEis the name of the bucket containing the object whose context you want to view. For example,my-bucket.OBJECT_NAMEis the name of the object whose context you want to view. For example,employees.txt
If successful, the response looks similar to the following example:
bucket: my-bucket
contexts:
Department:
createTime: '2023-01-01T00:00:00.000000+00:00'
type: CUSTOM
updateTime: '2023-01-01T00:00:00.000000+00:00'
value: Human resources
name: employees.txt
Client libraries
For more information, see the
Cloud Storage Java API
reference documentation.
To authenticate to Cloud Storage, set up Application Default Credentials.
For more information, see
Set up authentication for client libraries.
Before running code samples, set the Java
GOOGLE_CLOUD_UNIVERSE_DOMAIN environment
variable to s3nsapis.fr.
JSON API
Have gcloud CLI installed and initialized, which lets you generate an access token for the
Authorizationheader.Use
cURLto call the JSON API with aGETObject request:curl -X GET \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://storage.s3nsapis.fr/storage/v1/b/BUCKET_NAME/o/OBJECT_NAME"
Where:
BUCKET_NAMEis the name of the bucket containing the object whose context you want to view. For example,my-bucket.OBJECT_NAMEis the URL-encoded name of the object whose context you want to view. For example,employees.txt.
If successful, the response looks similar to the following example:
{ "kind": "storage#object", "name": "employees.txt", "bucket": "my-bucket", "contexts": { "custom": { "Department": { "value": "Human resources", "createTime": "2023-01-01T00:00:00.000Z", "updateTime": "2023-01-01T00:00:00.000Z" } } } }
Filter objects by contexts
Filter objects by the existence of object context keys or their specific values. Filtering objects by contexts helps to locate and manage particular groups of objects efficiently. For details, see Filter objects by contexts.
Manage object contexts during object operations
By default, Cloud Storage preserves object contexts when you copy, rewrite, compose, move, or restore objects.
Copy objects
By default, Cloud Storage preserves object contexts from the source object during a copy operation, even if you override other metadata. To modify object contexts during a copy operation, complete the following steps:
Command line
The gcloud storage cp command,
gcloud storage rsync command, and
gcloud storage mv command preserve contexts from the source
object by default. To modify contexts during these operations, use any of
the following flags:
The
--custom-contextsflag to set new contexts for the destination object.The
--clear-custom-contextsflag to prevent contexts from the source object from being attached to the destination object.A combination of the
--update-custom-contextsand--remove-custom-contextsflags to modify individual contexts from the source object before attaching them to the destination object.
To set new contexts when you copy an object, use the gcloud storage cp command:
gcloud storage cp gs://SOURCE_BUCKET_NAME/SOURCE_OBJECT_NAME gs://DESTINATION_BUCKET_NAME/DESTINATION_OBJECT_NAME --custom-contexts=KEY=VALUE,...
Where:
SOURCE_BUCKET_NAMEis the name of the bucket containing the object to copy. For example,my-source-bucket.SOURCE_OBJECT_NAMEis the name of the object to copy. For example,employees.txt.DESTINATION_BUCKET_NAMEis the name of the bucket to copy the object to. For example,my-destination-bucket.DESTINATION_OBJECT_NAMEis the name of the destination object. For example,employees-backup.txt.KEYis the context key to attach to an object. For example,Department. You can specify multiple key-value pairs separated by commas.VALUEis the value to associate with the context key. For example,Human resources.
To remove all contexts from the source object when you copy an object, use the gcloud storage cp command:
gcloud storage cp gs://SOURCE_BUCKET_NAME/SOURCE_OBJECT_NAME gs://DESTINATION_BUCKET_NAME/DESTINATION_OBJECT_NAME --clear-custom-contexts
Where:
SOURCE_BUCKET_NAMEis the name of the bucket containing the object to copy. For example,my-source-bucket.SOURCE_OBJECT_NAMEis the name of the object to copy. For example,pets/dog.png.DESTINATION_BUCKET_NAMEis the name of the bucket to copy the object to. For example,my-destination-bucket.DESTINATION_OBJECT_NAMEis the name of the destination object. For example,pets/cat.png.
To modify individual contexts from the source object when you copy an object,
use the gcloud storage cp command with --update-custom-contexts
and --remove-custom-contexts:
gcloud storage cp gs://SOURCE_BUCKET_NAME/SOURCE_OBJECT_NAME gs://DESTINATION_BUCKET_NAME/DESTINATION_OBJECT_NAME --update-custom-contexts=KEY=VALUE,... --remove-custom-contexts=KEY,...
Where:
SOURCE_BUCKET_NAMEis the name of the bucket containing the object to copy. For example,my-source-bucket.SOURCE_OBJECT_NAMEis the name of the object to copy. For example,pets/dog.png.DESTINATION_BUCKET_NAMEis the name of the bucket to copy the object to. For example,my-destination-bucket.DESTINATION_OBJECT_NAMEis the name of the destination object. For example,pets/cat.png.KEYis the context key to attach to an object. For example,Department. You can specify multiple key-value pairs or keys separated by commas.VALUEis the value to associate with the context key. For example,Human resources.
JSON API
To override contexts when copying an object, include the
contexts.custom property in the request body:
Have gcloud CLI installed and initialized, which lets you generate an access token for the
Authorizationheader.Create a JSON file that contains the contexts to attach to the destination object:
{ "contexts": { "custom": { "KEY": { "value": "VALUE" } } } }
Where:
KEYis the context key to attach to an object. For example,Department.VALUEis the value to associate with the context key. For example,Human resources.
Use
cURLto call the JSON API with aPOSTObject request:curl -X POST --data-binary @JSON_FILE_NAME \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json" \ "https://storage.s3nsapis.fr/storage/v1/b/SOURCE_BUCKET_NAME/o/SOURCE_OBJECT_NAME/copyTo/b/DESTINATION_BUCKET_NAME/o/DESTINATION_OBJECT_NAME"
Where:
JSON_FILE_NAMEis the path to the JSON file that includes the object contexts information.SOURCE_BUCKET_NAMEis the name of the bucket that contains the object to copy. For example,my-source-bucket.SOURCE_OBJECT_NAMEis the URL-encoded name of the object to copy. For example,employees.txt.DESTINATION_BUCKET_NAMEis the name of the bucket to copy the object to. For example,my-destination-bucket.DESTINATION_OBJECT_NAMEis the URL-encoded name of the destination object. For example,employees-backup.txt.
To remove all source contexts without providing an override, use the
dropContextGroups=custom query parameter in your request:
curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://storage.s3nsapis.fr/storage/v1/b/SOURCE_BUCKET_NAME/o/SOURCE_OBJECT_NAME/copyTo/b/DESTINATION_BUCKET_NAME/o/DESTINATION_OBJECT_NAME?dropContextGroups=custom"
To preserve contexts, omit the contexts.custom property from the request
body and exclude dropContextGroups=custom in query parameters:
curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://storage.s3nsapis.fr/storage/v1/b/SOURCE_BUCKET_NAME/o/SOURCE_OBJECT_NAME/copyTo/b/DESTINATION_BUCKET_NAME/o/DESTINATION_OBJECT_NAME"
For information about how contexts behave during copy operations, see the
dropContextGroups
query parameter.
Rewrite objects
By default, Cloud Storage preserves object contexts from the source object during a rewrite operation, even if you override other metadata. To modify object contexts during a rewrite operation, complete the following steps:
Command line
The gcloud storage cp command, gcloud storage rsync command,
and gcloud storage mv commands perform rewrites automatically when
necessary, for example, when copying objects between different locations or
storage classes. gcloud storage cp and gcloud storage rsync result in a
source and destination object, while gcloud storage mv creates the destination
object and removes the source object. Because these operations create a new
object, you can also modify or attach contexts as part of the same command by
using any of the following flags:
The
--custom-contextsflag to set new contexts for the destination object.The
--clear-custom-contextsflag to prevent contexts from the source object from being attached to the destination object.A combination of the
--update-custom-contextsand--remove-custom-contextsflags to modify individual contexts from the source object before attaching them to the destination object.
To set new contexts when you copy an object, use the gcloud storage cp command:
gcloud storage cp gs://SOURCE_BUCKET_NAME/SOURCE_OBJECT_NAME gs://DESTINATION_BUCKET_NAME/DESTINATION_OBJECT_NAME --custom-contexts=KEY=VALUE,...
Where:
SOURCE_BUCKET_NAMEis the name of the bucket containing the object to copy. For example,my-source-bucket.SOURCE_OBJECT_NAMEis the name of the object to copy. For example,employees.txt.DESTINATION_BUCKET_NAMEis the name of the bucket to copy the object to. For example,my-destination-bucket.DESTINATION_OBJECT_NAMEis the name of the destination object. For example,employees-backup.txt.KEYis the context key to attach to an object. For example,Department. You can specify multiple key-value pairs separated by commas.VALUEis the value to associate with the context key. For example,Human resources.
To remove all contexts from the source object when you copy an object, use the gcloud storage cp command:
gcloud storage cp gs://SOURCE_BUCKET_NAME/SOURCE_OBJECT_NAME gs://DESTINATION_BUCKET_NAME/DESTINATION_OBJECT_NAME --clear-custom-contexts
Where:
SOURCE_BUCKET_NAMEis the name of the bucket containing the object to copy. For example,my-source-bucket.SOURCE_OBJECT_NAMEis the name of the object to copy. For example,pets/dog.png.DESTINATION_BUCKET_NAMEis the name of the bucket to copy the object to. For example,my-destination-bucket.DESTINATION_OBJECT_NAMEis the name of the destination object. For example,pets/cat.png.
To modify individual contexts from the source object when you copy an object,
use the gcloud storage cp command with --update-custom-contexts
and --remove-custom-contexts:
gcloud storage cp gs://SOURCE_BUCKET_NAME/SOURCE_OBJECT_NAME gs://DESTINATION_BUCKET_NAME/DESTINATION_OBJECT_NAME --update-custom-contexts=KEY=VALUE,... --remove-custom-contexts=KEY,...
Where:
SOURCE_BUCKET_NAMEis the name of the bucket containing the object to copy. For example,my-source-bucket.SOURCE_OBJECT_NAMEis the name of the object to copy. For example,pets/dog.png.DESTINATION_BUCKET_NAMEis the name of the bucket to copy the object to. For example,my-destination-bucket.DESTINATION_OBJECT_NAMEis the name of the destination object. For example,pets/cat.png.KEYis the context key to attach to an object. For example,Department. You can specify multiple key-value pairs or keys separated by commas.VALUEis the value to associate with the context key. For example,Human resources.
JSON API
To override contexts when rewriting an object, include the
contexts.custom property in the request body:
Have gcloud CLI installed and initialized, which lets you generate an access token for the
Authorizationheader.Create a JSON file that contains the contexts to attach to the destination object:
{ "contexts": { "custom": { "KEY": { "value": "VALUE" } } } }
Where:
KEYis the context key to attach to an object. For example,Department.VALUEis the value to associate with the context key. For example,Human resources.
Use
cURLto call the JSON API with aPOSTrewrite Object request:curl -X POST --data-binary @JSON_FILE_NAME \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json" \ "https://storage.s3nsapis.fr/storage/v1/b/SOURCE_BUCKET_NAME/o/SOURCE_OBJECT_NAME/rewriteTo/b/DESTINATION_BUCKET_NAME/o/DESTINATION_OBJECT_NAME"
Where:
JSON_FILE_NAMEis the path to the JSON file that includes the object contexts information.SOURCE_BUCKET_NAMEis the name of the bucket that contains the object to rewrite. For example,my-source-bucket.SOURCE_OBJECT_NAMEis the URL-encoded name of the object to rewrite. For example,employees.txt.DESTINATION_BUCKET_NAMEis the name of the bucket to rewrite the object to. For example,my-destination-bucket.DESTINATION_OBJECT_NAMEis the URL-encoded name of the destination object. For example,employees-backup.txt.
To remove all source contexts without providing an override, use the
dropContextGroups=custom query parameter in your request:
curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://storage.s3nsapis.fr/storage/v1/b/SOURCE_BUCKET_NAME/o/SOURCE_OBJECT_NAME/rewriteTo/b/DESTINATION_BUCKET_NAME/o/DESTINATION_OBJECT_NAME?dropContextGroups=custom"
To preserve contexts, omit
the contexts.custom property from the request body and exclude
dropContextGroups=custom in query parameters:
curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://storage.s3nsapis.fr/storage/v1/b/SOURCE_BUCKET_NAME/o/SOURCE_OBJECT_NAME/rewriteTo/b/DESTINATION_BUCKET_NAME/o/DESTINATION_OBJECT_NAME"
For information about how contexts behave during rewrite operations, see the
dropContextGroups
query parameter.
Compose objects
The gcloud storage objects compose command and the JSON API
compose method merge contexts from the source objects and attach them to
the destination objects by default. Cloud Storage resolves conflicts by
prioritizing contexts from source objects processed later. For more information
about the object context behavior during a compose operation, see
Composite object contexts.
Command line
To specify new contexts for the destination object when composing objects, use the
--contexts flag:
gcloud storage objects compose gs://BUCKET_NAME/SOURCE_OBJECT_1 gs://BUCKET_NAME/SOURCE_OBJECT_2 gs://BUCKET_NAME/DESTINATION_OBJECT_NAME --contexts=KEY=VALUE,...
Where:
BUCKET_NAMEis the name of the bucket that contains the source objects and where the destination object is created. For example,my-bucket.SOURCE_OBJECT_1andSOURCE_OBJECT_2are source objects to compose.DESTINATION_OBJECT_NAMEis the name of the destination object to be created. For example,my-composite-object.KEYis the context key to attach to an object. For example,Department. You can specify multiple key-value pairs separated by commas.VALUEis the value to associate with the context key. For example,Human resources.
To prevent source contexts from being attached to composite objects, use the
--clear-custom-contexts flag:
gcloud storage objects compose gs://BUCKET_NAME/SOURCE_OBJECT_1 gs://BUCKET_NAME/SOURCE_OBJECT_2 gs://BUCKET_NAME/DESTINATION_OBJECT_NAME --clear-custom-contexts
Where:
BUCKET_NAMEis the name of the bucket that contains source objects and where the destination object is created. For example,my-bucket.SOURCE_OBJECT_1andSOURCE_OBJECT_2are the source objects to compose.DESTINATION_OBJECT_NAMEis the name of the destination object to be created. For example,my-composite-object.
JSON API
To specify new contexts for the destination object when composing objects,
include contexts in the destination property of the request body.
Have gcloud CLI installed and initialized, which lets you generate an access token for the
Authorizationheader.Create a JSON file that contains the request body:
{ "sourceObjects": [ {"name": "SOURCE_OBJECT_1"}, {"name": "SOURCE_OBJECT_2"} ], "destination": { "contentType": "text/plain", "contexts": { "custom": { "KEY": { "value": "VALUE" } } } } }
Where:
SOURCE_OBJECT_1andSOURCE_OBJECT_2are source objects to compose.KEYis the context key to attach to an object. For example,Department.VALUEis the value to associate with the context key. For example,Human resources.
Use
cURLto call the JSON API with aPOSTcompose Object request:curl -X POST --data-binary @JSON_FILE_NAME \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json" \ "https://storage.s3nsapis.fr/storage/v1/b/BUCKET_NAME/o/DESTINATION_OBJECT_NAME/compose"
Where:
JSON_FILE_NAMEis the path to the JSON file that includes the request body.BUCKET_NAMEis the name of the bucket that contains source objects and where the destination object will be created. For example,my-bucket.DESTINATION_OBJECT_NAMEis the name of the destination object to be created. For example,my-composite-object.
To prevent source contexts from being attached to composite objects, use the
dropContextGroups=custom query parameter in your request:
Have gcloud CLI installed and initialized, which lets you generate an access token for the
Authorizationheader.Create a JSON file that contains the request body:
{ "sourceObjects": [ {"name": "SOURCE_OBJECT_1"}, {"name": "SOURCE_OBJECT_2"} ], "destination": { "contentType": "text/plain" } }
Where:
SOURCE_OBJECT_1andSOURCE_OBJECT_2are source objects to compose.
Use
cURLto call the JSON API with aPOSTcompose Object request:curl -X POST --data-binary @JSON_FILE_NAME \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json" \ "https://storage.s3nsapis.fr/storage/v1/b/BUCKET_NAME/o/DESTINATION_OBJECT_NAME/compose?dropContextGroups=custom"
Where:
JSON_FILE_NAMEis the path to the JSON file that includes the request body.BUCKET_NAMEis the name of the bucket that contains source objects and where the destination object will be created. For example,my-bucket.DESTINATION_OBJECT_NAMEis the name of the destination object to be created. For example,my-composite-object.
What's next
- Learn about the object context properties in the Cloud Storage API documentation.