;}%20.st6{fill:url(%23SVGID_00000021089067129159788970000008246765442136188072_);}%20.st7{fill:url(%23SVGID_00000117639240116366130650000015074833605515028638_);}%20.st8{opacity:0.4;fill:url(%23SVGID_00000101781798616409025840000016567063639337360777_);}%20.st9{opacity:0.4;fill:url(%23SVGID_00000052086836598721292040000002033117744178971046_);}%20.st10{opacity:0.4;fill:url(%23SVGID_00000159460939004760751800000002448009281983951536_);}%20.st11{opacity:0.4;fill:url(%23SVGID_00000013177830667419993080000017721442101626521532_);}%20.st12{opacity:0.4;fill:url(%23SVGID_00000152235521444854938490000006526001119318383285_);}%20.st13{opacity:0.4;fill:url(%23SVGID_00000119823135212293698520000012774889010992664993_);}%20%3c/style%3e%3cg%3e%3cpolygon%20class='st2'%20points='134.78,14.22%20114.31,48.21%20101.33,69.75%20158.22,69.75%20177.97,36.95%20191.67,14.22%20'/%3e%3cpolygon%20class='st3'%20points='227.55,69.75%20186.61,69.75%20101.33,69.75%20129.78,119.02%20158.16,119.02%20228.61,119.02%20256,119.02%20'/%3e%3cpolygon%20class='st3'%20points='136.93,132.47%20116.46,167.93%2073.82,241.78%20130.71,241.78%20144.9,217.2%20180.13,156.18%20193.82,132.46%20'/%3e%3cpolygon%20class='st3'%20points='121.7,131.95%20101.23,96.49%2058.59,22.63%2030.15,71.91%2044.34,96.49%2079.57,157.5%2093.26,181.22%20'/%3e%3cpolygon%20class='st2'%20points='64.81,131.95%2025.15,131.21%200,130.74%2028.44,180.01%2066.73,180.72%2093.26,181.21%20'/%3e%3cpolygon%20class='st2'%20points='165.38,181.74%20184.58,216.46%20196.75,238.47%20225.19,189.2%20206.66,155.69%20193.83,132.46%20'/%3e%3c/g%3e%3c/svg%3e)
Windmill HubGoogle Cloud
Cloud Service account keyCall Google Cloud APIs — Cloud Storage, Compute, BigQuery — from any Windmill script, flow or app with a service account.
Set up in 3 steps
Create a service account and a key
In the Google Cloud console, open IAM & Admin, then Service Accounts. Create one, grant it the roles your scripts need, then add a key and download the JSON.
Add the resource in Windmill
Open Resources, add a resource of type gcloud, and paste the JSON — its fields map one to one.
Run your first script
Fork any script below and read before writing anything.
Scripts
Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.
Big Query Insert Rows
Create Bucket
Get Bucket
Get Object
List Buckets
Logging Write Log
Search Objects
Upload Object
Write Log
Bigquery Insert Rows
Get Object
List Buckets
Search Objects
Get Bucket Metadata
Upload An Object
Switch Instance Boot Status
Run Query
Create Bucket
Create Scheduled Query
Resource type
gcloud — the shape of the credential every script on this page expects.
| Field | Type | Required | What it is |
|---|---|---|---|
| auth_provider_x509_cert_url | string | Yes | |
| auth_uri | string | Yes | |
| client_email | string | Yes | |
| client_id | string | Yes | |
| client_x509_cert_url | string | Yes | |
| private_key | string | Yes | |
| private_key_id | string | Yes | |
| project_id | string | Yes | |
| token_uri | string | Yes | |
| type | string | Yes |
All resource types
Questions
What is gcloud_storage for?
It pairs a bucket name with the same service account key, so a script that only ever works in one bucket does not repeat it. The credential inside is identical.
Which roles should I grant?
Only what the scripts call. A service account key does not expire, so its blast radius is whatever you granted it, indefinitely.
Are my credentials stored on the hub?
Never. They live only in your own Windmill workspace, encrypted at rest.