Stay organized with collections
Save and categorize content based on your preferences.
Use secure copy (SCP) from the command line to transfer files to
Google Distributed Cloud air-gapped virtual machine (VM) instances.
Before you begin
You need the following to use the SCP command-line tool to
transfer files to VMs:
You must manually manage your SSH keys.
You must enable ingress on port 22 for your VM. See the Enable IP addresses page for more information.
The SCP tool uses the same key files that you use to connect to your instances
using standard SSH.
Request permissions and access
To perform the tasks listed in this page, you must have the Project
VirtualMachine Admin role. Follow the steps to
verify
that you have the Project VirtualMachine Admin (project-vm-admin) role in the namespace
of the project where the VM resides.
Transfer files to VMs
Locate the external IP address for the VM to which you want to send files using
the instructions on the Enable IP addresses
page.
Use the SCP tool to copy a file from your workstation to the home directory of
the target VM in the following example, which uses a private key at
~/.ssh/my-ssh-key:
The name of the local file
that you want to upload.
USERNAME
Your username.
IP_ADDRESS
The VM's external ingress IP address.
Transfer files from a VM
To copy files from a VM to your local workstation, reverse the source and
destination variables. The following example shows how to copy a file from your
VM to a path on your workstation:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eSCP (secure copy) is used to transfer files to and from Google Distributed Cloud air-gapped virtual machine (VM) instances via the command line.\u003c/p\u003e\n"],["\u003cp\u003eTo use SCP, you must have access management enabled, manually manage your SSH keys, and enable ingress on port 22 for your VM.\u003c/p\u003e\n"],["\u003cp\u003eTransfer files to a VM by using the SCP command \u003ccode\u003escp -i ~/.ssh/my-ssh-key LOCAL_FILE_PATH USERNAME@IP_ADDRESS:~\u003c/code\u003e, replacing the variables with your file path, username, and the VM's external IP.\u003c/p\u003e\n"],["\u003cp\u003eTransfer files from a VM to your workstation using the SCP command \u003ccode\u003escp -i ~/.ssh/my-ssh-key USERNAME@IP_ADDRESS:REMOTE_FILE_PATH LOCAL_FILE_PATH\u003c/code\u003e, replacing variables with your credentials and file paths.\u003c/p\u003e\n"],["\u003cp\u003eYou must have the Project VirtualMachine Admin role to perform file transfer tasks to VMs.\u003c/p\u003e\n"]]],[],null,["# Transfer files\n\nUse secure copy (SCP) from the command line to transfer files to\nGoogle Distributed Cloud air-gapped virtual machine (VM) instances.\n\nBefore you begin\n----------------\n\n| **Important:** You *must already have access management enabled* to proceed. If you do not, follow the steps in [Guest environment](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vms/manage-the-os/guest-environment). By default, access management is enabled.\nYou need the following to use the SCP command-line tool to transfer files to VMs:\n\n- You must manually manage your SSH keys.\n- You must enable ingress on port 22 for your VM. See the [Enable IP addresses](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vms/connect-to-vm/ip-addresses) page for more information.\n\nThe SCP tool uses the same key files that you use to connect to your instances\nusing standard SSH.\n| **Important:** If you haven't yet applied a public key to your VM instance, create an SSH key pair and add the public key to the VM following the instructions in [Linux (SSH)](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vms/connect-to-vm/connect-to-a-vm#api).\n\n### Request permissions and access\n\nTo perform the tasks listed in this page, you must have the Project\nVirtualMachine Admin role. Follow the steps to\n[verify](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vms/preparation#verify-user-access)\nthat you have the Project VirtualMachine Admin (`project-vm-admin`) role in the namespace\nof the project where the VM resides.\n\nTransfer files to VMs\n---------------------\n\nLocate the external IP address for the VM to which you want to send files using\nthe instructions on the [Enable IP addresses](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/vms/connect-to-vm/ip-addresses)\npage.\n\nUse the SCP tool to copy a file from your workstation to the home directory of\nthe target VM in the following example, which uses a private key at\n`~/.ssh/my-ssh-key`: \n\n scp -i ~/.ssh/my-ssh-key \u003cvar translate=\"no\"\u003eLOCAL_FILE_PATH\u003c/var\u003e \u003cvar translate=\"no\"\u003eUSERNAME\u003c/var\u003e@\u003cvar translate=\"no\"\u003eIP_ADDRESS\u003c/var\u003e:~\n\nUse the following definitions for your variables.\n\nTransfer files from a VM\n------------------------\n\nTo copy files from a VM to your local workstation, reverse the source and\ndestination variables. The following example shows how to copy a file from your\nVM to a path on your workstation: \n\n scp -i ~/.ssh/my-ssh-key \u003cvar translate=\"no\"\u003eUSERNAME\u003c/var\u003e@\u003cvar translate=\"no\"\u003eIP_ADDRESS\u003c/var\u003e:\u003cvar translate=\"no\"\u003eREMOTE_FILE_PATH\u003c/var\u003e \u003cvar translate=\"no\"\u003eLOCAL_FILE_PATH\u003c/var\u003e\n\nUse the following definitions for your variables."]]
