Regional endpoints

This page describes how to use regional endpoints to access resources in Cloud Storage. Using regional endpoints lets you run your workloads in a manner that complies with data residency and data sovereignty requirements, where your request traffic is routed directly to the region specified in the endpoint.

Overview

Regional endpoints are request endpoints that only allow requests to proceed if the affected resource exists in the location specified by the endpoint. For example, when you use the endpoint https://storage.me-central2.rep.googleapis.com in a delete bucket request, the request only proceeds if the bucket is located in ME-CENTRAL2.

Unlike global endpoints, where requests can be processed in a different location from where the resource resides, regional endpoints guarantee that your requests are processed only within the location specified by the endpoint where the resource resides. Regional endpoints terminate TLS sessions in the location specified by the endpoint for requests received from the Internet, other Google Cloud resources (such as Compute Engine virtual machines), on-premise services using VPN or Interconnect, and Virtual Private Clouds (VPCs).

Regional endpoints guarantee data residency by ensuring that your object's data at rest and in transit does not get moved out of the location specified by the endpoint. This guarantee excludes resource metadata, such as object names and bucket IAM policies. For more information, see Note on service data.

Supported locations

You can use regional endpoints to keep your data within the following locations:

European Union
- Frankfurt, Germany (EUROPE-WEST3 region) (Preview)
- Milan, Italy (EUROPE-WEST8 region) (Preview)
- Paris, France (EUROPE-WEST9 region) (Preview)
Kingdom of Saudi Arabia
- Dammam, Saudi Arabia (ME-CENTRAL2 region)
United States
- Iowa (US-CENTRAL1 region)
- South Carolina (US-EAST1 region)
- Northern Virginia (US-EAST4 region)
- Columbus (US-EAST5 region)
- Dallas (US-SOUTH1 region)
- Oregon (US-WEST1 region)
- Los Angeles (US-WEST2 region)
- Salt Lake City (US-WEST3 region)
- Las Vegas (US-WEST4 region)

Supported operations

Regional endpoints can only be used to perform operations that access or mutate resources within the location specified by the endpoint. Regional endpoints cannot be used to perform operations that access or mutate resources outside of the location specified by the endpoint.

For example, when you use the regional endpoint https://storage.me-central2.rep.googleapis.com, you can read objects in buckets located in ME-CENTRAL2, and copy an object from a source bucket to a destination bucket only when both buckets are located in ME-CENTRAL2. If you attempt to read or copy an object outside of ME-CENTRAL2, you get an error.

Regional endpoints can be used to perform supported bucket, object, and inventory report operations, as long as the operations are performed on resources stored in the location specified by the endpoint.

For a full list of operations that are supported in Cloud Storage, expand the Supported operations section:

Supported operations

Object operations
- Creating objects
- Composing objects
- Copying objects¹
- Deleting objects
- Getting object metadata²
- Listing objects
- Patching objects
- Rewriting objects¹
- Updating objects
Bucket operations
- Creating buckets
- Deleting buckets
- Getting bucket metadata²
- Listing buckets
- Locking bucket retention policies
- Patching buckets
- Updating buckets
Operations on IAM policies
- Getting bucket IAM policies²
- Updating bucket IAM policies²
- Testing bucket IAM policies²
Operations on ACLs
- Creating object ACLs²
- Creating default object ACLs for a bucket²
- Deleting object ACLs²
- Deleting default object ACLs for a bucket²
- Getting object ACLs²
- Getting default object ACLs for a bucket²
- Listing object ACLs²
- Listing default object ACLs for a bucket²
- Patching object ACLs²
- Patching default object ACLs for a bucket²
- Updating object ACLs²
- Updating default object ACLs for a bucket²
Storage Insights operations
- Creating inventory report configurations
- Deleting inventory report configurations
- Getting inventory reports
- Getting inventory report configurations
- Listing inventory reports
- Listing inventory report configurations
- Patching inventory report configurations

¹This operation only succeeds if the source and destination buckets are in the location specified by the endpoint.

²This operation accesses or mutates metadata. Compliance with data residency and data sovereignty requirements are not guaranteed for this operation.

Limitations and restrictions

Regional endpoints cannot be used to perform the following operations:

Operations that access or mutate resources outside of the location specified by the endpoint
Copying or rewriting resources from one location to another
HMAC key operations
Service account operations
Pub/Sub notification operations

Object Change Notification operations

JSON batch operations

Keep in mind the following restrictions when using regional endpoints:

Regional endpoints don't support mutual TLS (mTLS).
Regional endpoints only support HTTPS. HTTP is not supported.
Regional endpoints don't support bucket subdomains in the XML API.

Tools for using regional endpoints

Console

To access Cloud Storage resources in a manner that's compliant with data residency or sovereignty requirements, use the jurisdictional Google Cloud console URLs:

Resource	URL
Bucket list for a project	`https://console.JURISDICTION.cloud.google.com/storage/browser?project=PROJECT_ID`
Object list for a bucket	`https://console.JURISDICTION.cloud.google.com/storage/browser/BUCKET_NAME`
Details for an object	`https://console.JURISDICTION.cloud.google.com/storage/browser/_details/BUCKET_NAME/OBJECT_NAME`

Replace JURISDICTION with one of the following values:

eu if the resource is located in the European Union
sa if the resource is located in the Kingdom of Saudi Arabia
us if the resource is located in the United States

Command line

To configure the Google Cloud CLI for use with regional endpoints, complete the following steps:

Make sure you're using the Google Cloud CLI 402.0.0 or newer.

Set the api_endpoint_overrides/storage property to the regional endpoint you want to use:

gcloud config set api_endpoint_overrides/storage https://storage.LOCATION.rep.googleapis.com/

Alternatively, you can set the CLOUDSDK_API_ENDPOINT_OVERRIDES_STORAGE environment variable to the endpoint:

CLOUDSDK_API_ENDPOINT_OVERRIDES_STORAGE=https://storage.LOCATION.rep.googleapis.com/ gcloud ls gs://my-bucket

REST APIs

JSON API

When making requests to regional endpoints, use the following URIs:

For general JSON API requests, excluding object uploads, use the following endpoint, replacing LOCATION with a supported bucket location:
```
https://storage.LOCATION.rep.googleapis.com
```
For example, the following endpoint is used to create a bucket in the ME-CENTRAL2 region:
```
https://storage.me-central2.rep.googleapis.com
```
For JSON API object uploads, use the following endpoint:
```
https://storage.LOCATION.rep.googleapis.com/upload/storage/v1/b/BUCKET_NAME/o
```
Replace:
- LOCATION with a supported bucket location.
- BUCKET_NAME with the name of the bucket to which you want to upload an object.
For example, the following endpoint is used to upload an object to a bucket in the ME-CENTRAL2 region:
```
https://storage.me-central2.rep.googleapis.com/upload/storage/v1/b/my-example-bucket/o
```
For JSON API object downloads, use the following endpoint:
```
https://storage.LOCATION.rep.googleapis.com/download/storage/v1/b/BUCKET_NAME/o/OBJECT_NAME?alt=media
```
Replace:
- LOCATION with a supported bucket location.
- BUCKET_NAME with the name of the bucket that contains the object you want to download.
- OBJECT_NAME with the name of the object you want to download.

XML API

When making requests to regional endpoints, use the following path-style endpoint:

https://storage.LOCATION.rep.googleapis.com/BUCKET_NAME

Replace:

LOCATION with a supported bucket location.
BUCKET_NAME with the name of a bucket.

For example, the following sample can be used to upload an object to a bucket in the ME-CENTRAL2 region:

https://storage.me-central2.rep.googleapis.com/my-example-bucket