> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://help.sigmacomputing.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://help.sigmacomputing.com/_mcp/server.

# Configure an external storage integration with Google Cloud Storage

> Configure a Sigma external storage integration with Google Cloud Storage for file uploads, result cache, and cloud exports.

Configure an external storage integration using a customer-owned Google Cloud Storage (GCS) bucket to give your organization full control over file location, access, retention, and encryption. Some features, like [file upload columns](/docs/configure-file-upload-columns-on-input-tables) in input tables, [universal result cache](/docs/manage-universal-result-cache), and [exports to cloud storage](/docs/export-to-cloud-storage) require an external storage integration. Other features, like [CSV upload](/docs/upload-csv-data), have default storage flows that use a Sigma-owned bucket, but you can enable the use of a customer-owned bucket instead.

This document explains how to configure a storage integration with a customer-owned GCS bucket. For information about the general and feature-specific advantages of an external storage integration, see [External storage integration overview](/docs/external-storage-integration-overview).

Most of the storage integration configuration requires you to complete steps within a GCP project or your data platform. Because these workflows are maintained and updated by a third party, the steps detailed in this document may reference different UI and terminology than GCP or your data platform.

## Requirements

The ability to configure a storage integration that uses a customer-owned GCS bucket requires the following:

* In Sigma, you must be assigned the Admin [account type](/docs/account-type-and-license-overview).
* In GCP, you must be granted administrative permissions or have the ability to create and manage a GCS bucket.
* In GCP, you must also be granted permissions required to create and manage core security policies (e.g., IAM roles and service account configurations).
* Your Sigma organization must be hosted in GCP. If your organization is hosted in Amazon Web Services (AWS) or Microsoft Azure, see [Configure an external storage integration with Amazon S3](/docs/configure-an-external-storage-integration-with-amazon-s3) or [Configure an external storage integration with Azure Blob Storage](/docs/configure-an-external-storage-integration-with-azure-blob).

## Configure a storage integration with GCS

To configure a storage integration that uses your own GCS bucket, complete the following procedures:

* [Configure a target bucket in GCP](#configure-a-target-bucket-in-gcp)
* [Configure a service account in GCP](#configure-a-service-account-in-gcp)
* [Configure warehouse-specific external storage access](#configure-warehouse-specific-external-storage-access)
* [Add a GCS integration in Sigma](#add-a-gcs-integration-in-sigma)
* [Grant impersonation access to the service account in GCP](#grant-impersonation-access-to-the-service-account-in-gcp)
* [Enable cross-origin resource sharing (CORS) in GCP](#enable-cross-origin-resource-sharing-cors-in-gcp)
* [Create an IP allowlist in GCP](#create-an-ip-allowlist-in-gcp)
* [Configure an object lifecycle rule in GCP to manage time to live (TTL)](#configure-an-object-lifecycle-rule-in-gcp-to-manage-time-to-live-ttl)

### Configure a target bucket in GCP

In your GCP project, create a dedicated target bucket for file uploads. You can select storage options as you see fit, but <a href="https://docs.cloud.google.com/storage/docs/storage-classes" target="_blank">Standard storage</a> is recommended. For detailed instructions, see <a href="https://docs.cloud.google.com/storage/docs/creating-buckets" target="_blank">Create a bucket</a> in the GCP documentation.

### Configure a service account in GCP

In your GCP project, configure a service account with Storage Object Admin permissions to mediate access to the bucket. For detailed instructions, see <a href="https://docs.cloud.google.com/iam/docs/service-accounts-create#creating" target="_blank">Create service accounts</a> in the GCP documentation.

### Configure warehouse-specific external storage access

If your organization is connected to Snowflake, Databricks, or BigQuery, and CSV upload is configured to use [external stages](/docs/configure-csv-upload-and-storage-options#choose-internal-or-external-stages-for-csv-uploads), you must configure external storage access. The required permissions depend on your data platform. Refer to the relevant section below.

* [Configure external storage access in Snowflake](#configure-external-storage-access-in-snowflake)
* [Configure external storage access in Databricks](#configure-external-storage-access-in-databricks)
* [Configure external storage access in BigQuery](#configure-external-storage-access-in-bigquery)

#### Configure external storage access in Snowflake

1. In Snowflake, create a storage integration object that enables access to the GCS bucket. See <a href="https://docs.snowflake.com/en/user-guide/data-load-gcs-config" target="_blank">Configure an integration for Google Cloud Storage</a> in the Snowflake documentation. Record the name of the integration object for later use.

2. Use the `DESCRIBE INTEGRATION {integration_name}` command to retrieve the name of the service account referenced by the integration object.

3. Grant the following permissions to the service account:
   * Storage Bucket Viewer
   * Storage Object Viewer

#### Configure external storage access in Databricks

1. In Databricks, create an external location. See <a href="https://docs.databricks.com/gcp/en/sql/language-manual/sql-ref-external-locations" target="_blank">External locations</a> in the Databricks documentation. Record the name of the external location for later use.

2. Configure a credential set to be used with the external location. See <a href="https://docs.databricks.com/gcp/en/sql/language-manual/sql-ref-storage-credentials" target="_blank">Credentials</a>.

3. Grant the following permissions to the service account associated with the credential view:
   * Storage Object Viewer
   * Storage Object Creator

#### Configure external storage access in BigQuery

1. Identify the service account or identities associated with your organization's BigQuery connection.

2. In Google Cloud Console, open the target bucket, then grant the service account the Storage Object Viewer IAM role.

### Add a GCS integration in Sigma

You can now add a storage integration in Sigma using a GCS bucket.

1. In Sigma, go to **Administration** > **Account** > **General Settings**.

2. In the **Storage Integration** > **External storage integration** section, click **Add**.

3. In the **Add storage integration** modal, provide the required GCP credentials.

   1. In the **Provider** section, select **Google Cloud Storage**.

   2. In the **Service account** field, enter the service account ID.

   3. (Required by Snowflake and Databricks connections only) In the **Warehouse storage integration name** field, enter the name of the Snowflake storage integration object or Databricks external location. See [Configure warehouse-specific external storage access](#configure-warehouse-specific-external-storage-access) for more information.

   4. In the **Bucket name** field, enter the name of the GCS bucket.

   5. In the **Path prefix** field, enter any folder path prefix.

4. Click **Save**.

### Grant impersonation access to the service account in GCP

In your GCP project, grant impersonation access to the service account with the `Service Account Token Creator` role. For detailed instructions, see <a href="https://docs.cloud.google.com/iam/docs/service-account-impersonation" target="_blank">Service account impersonation</a> and <a href="https://docs.cloud.google.com/iam/docs/manage-access-service-accounts" target="_blank">Manage access to service accounts</a> in the GCP documentation.

### Enable cross-origin resource sharing (CORS) in GCP

In your GCP project, enable CORS for the target bucket. For detailed instructions, see <a href="https://docs.cloud.google.com/storage/docs/using-cors" target="_blank">Set up and view CORS configurations</a> in the GCP documentation.

Use the following CORS configuration:

```json
{
    "origin": ["https://app.sigmacomputing.com"],
    "method": ["GET", "POST", "PUT"],
    "responseHeader": ["*"],
    "maxAgeSeconds": 3600
}
```

This snippet shows a single rule that can be added to an existing list of CORS rules. If there are no other CORS rules configured, wrap the snippet in `[]`.

### Create an IP allowlist in GCP

(Optional) In your GCP project, create IP filtering rules to limit access to your bucket based on IP address. Only traffic from approved IP address ranges will be allowed. For detailed instructions, see <a href="https://docs.cloud.google.com/storage/docs/update-ip-filter" target="_blank">Create or update IP filtering rules on an existing bucket</a> in the GCP documentation.

Before you create the filtering rules, you must obtain the relevant IP address ranges.

* Sigma cluster IP addresses: See [Add Sigma IPs to the allowlist](/docs/connect-to-data-sources#add-sigma-ips-to-the-allowlist).
* User IP addresses: Office IP addresses, VPN IP addresses, and any other IP addresses that your Sigma organization users will use to access Sigma.
* Data platform IP addresses: IP addresses used by Snowflake or Databricks instances connected to your Sigma organization. *This is only required when using [external stages for CSV uploads](/docs/configure-csv-upload-and-storage-options#choose-internal-or-external-stages-for-csv-uploads) because the data platform must access the bucket directly.*

### Configure an object lifecycle rule in GCP to manage time to live (TTL)

(Optional) In your GCP project, create an object lifecycle rule to clear cached queries that are no longer in use by the [universal result cache](/docs/manage-universal-result-cache). Sigma recommends configuring an object lifecycle rule with an action that deletes objects that match the `<path-prefix>/cloudcache` prefix after 2 days.

For detailed instructions, see <a href="https://docs.cloud.google.com/storage/docs/lifecycle" target="_blank">Object lifecycle management</a> in the GCP documentation.

When using the [universal result cache](/docs/manage-universal-result-cache), results are stored in a bucket at the path `<path-prefix>/cloudcache`, where `<path-prefix>` is the folder **Path prefix** you configured when [adding a GCS integration in Sigma](#add-a-gcs-integration-in-sigma).