[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Regional endpoints\n\nThis page describes how to use regional endpoints to access resources in\nCloud Storage. Using regional endpoints lets you run your\nworkloads in a manner that complies with [data residency](/assured-workloads/docs/data-residency) and data\nsovereignty requirements, where your request traffic is routed directly to the\nregion specified in the endpoint.\n\nOverview\n--------\n\nRegional endpoints are request endpoints that only allow requests to proceed if\nthe affected resource exists in the location specified by the endpoint. For\nexample, when you use the endpoint\n`https://storage.me-central2.rep.googleapis.com` in a delete bucket request,\nthe request only proceeds if the bucket is located in `ME-CENTRAL2`.\n\nUnlike global endpoints, where requests can be processed in a different\nlocation from where the resource resides, regional endpoints guarantee that your\nrequests are processed only within the location specified by the endpoint where\nthe resource resides. Regional endpoints terminate TLS sessions in the location\nspecified by the endpoint for requests received from the Internet, other\nGoogle Cloud resources (such as Compute Engine virtual machines), on-premise\nservices using VPN or Interconnect, and Virtual Private Clouds (VPCs).\n\nRegional endpoints guarantee data residency by ensuring that your\nobject's data at rest and in transit does not get moved out of the location\nspecified by the endpoint. This guarantee excludes resource metadata, such as\nobject names and bucket IAM policies. For more information,\nsee [Note on service data](/assured-workloads/docs/data-residency#service-data).\n\nSupported locations\n-------------------\n\nYou can use regional endpoints to keep your data within the following\n[locations](/storage/docs/locations):\n\n- All regions\n\n- `US` multi-region\n\n- `EU` multi-region\n\nSupported operations\n--------------------\n\nRegional endpoints can only be used to perform operations that access or mutate\nresources within the location specified by the endpoint. Regional endpoints\ncannot be used to perform operations that access or mutate resources outside of\nthe location specified by the endpoint.\n\nFor example, when you use the regional endpoint\n`https://storage.me-central2.rep.googleapis.com`, you can read objects in\nbuckets located in `ME-CENTRAL2`, and copy an object from a source bucket to a\ndestination bucket only when both buckets are located in `ME-CENTRAL2`. If you\nattempt to read or copy an object outside of `ME-CENTRAL2`, you get an\nerror.\n\nRegional endpoints can be used to perform supported bucket, object, and\ninventory report operations, as long as the operations are performed on\nresources stored in the location specified by the endpoint.\n\nFor a full list of operations that are supported in Cloud Storage,\nexpand the **Supported operations** section:\n\n#### Supported operations\n\n- Object operations\n - Creating objects\n - Composing objects\n - Copying objects^1^\n - Deleting objects\n - Getting object metadata^2^\n - Listing objects\n - Patching objects\n - Rewriting objects^1^\n - Updating objects\n- Bucket operations\n - Creating buckets\n - Deleting buckets\n - Getting bucket metadata^2^\n - Listing buckets\n - Locking bucket retention policies\n - Patching buckets\n - Updating buckets\n- Operations on IAM policies\n - Getting bucket IAM policies^2^\n - Updating bucket IAM policies^2^\n - Testing bucket IAM policies^2^\n- Operations on ACLs\n - Creating object ACLs^2^\n - Creating default object ACLs for a bucket^2^\n - Deleting object ACLs^2^\n - Deleting default object ACLs for a bucket^2^\n - Getting object ACLs^2^\n - Getting default object ACLs for a bucket^2^\n - Listing object ACLs^2^\n - Listing default object ACLs for a bucket^2^\n - Patching object ACLs^2^\n - Patching default object ACLs for a bucket^2^\n - Updating object ACLs^2^\n - Updating default object ACLs for a bucket^2^\n- Storage Insights operations\n - Creating inventory report configurations\n - Deleting inventory report configurations\n - Getting inventory reports\n - Getting inventory report configurations\n - Listing inventory reports\n - Listing inventory report configurations\n - Patching inventory report configurations\n\n^1^This operation only succeeds if the source and destination\nbuckets are in the location specified by the endpoint.\n\n^2^This operation accesses or mutates metadata. Compliance with\ndata residency and data sovereignty requirements are not guaranteed for this\noperation.\n\nLimitations and restrictions\n----------------------------\n\nRegional endpoints cannot be used to perform the following operations:\n\n- Copying or rewriting resources from one location to another\n\n- [HMAC key](/storage/docs/authentication/hmackeys) operations\n\n- [Service account](/storage/docs/projects#service-accounts) operations\n\n- [Pub/Sub notification](/storage/docs/pubsub-notifications) operations\n\n- [JSON batch](/storage/docs/batch) operations\n\nKeep in mind the following restrictions when using regional endpoints:\n\n- Regional endpoints don't support [mutual TLS (mTLS)](/storage/docs/request-endpoints#mtls).\n\n- Regional endpoints only support HTTPS. HTTP is not supported.\n\nTools for using regional endpoints\n----------------------------------\n\n### Console\n\nTo access Cloud Storage resources in a manner that's compliant with\ndata residency or sovereignty requirements, use the jurisdictional\nGoogle Cloud console URLs:\n\nReplace \u003cvar translate=\"no\"\u003eJURISDICTION\u003c/var\u003e with one of the following\nvalues:\n\n- `eu` if the resource is located in the European Union\n\n- `sa` if the resource is located in the Kingdom of Saudi Arabia\n\n- `us` if the resource is located in the United States\n\n| **Note:** You cannot use the jurisdictional Google Cloud console to upload or download objects.\n\n### Command line\n\nTo configure the Google Cloud CLI for use with regional endpoints,\ncomplete the following steps:\n\n1. Make sure you're using the Google Cloud CLI 402.0.0 or newer.\n\n2. Set the `api_endpoint_overrides/storage` property to the regional\n endpoint you want to use:\n\n ```\n gcloud config set api_endpoint_overrides/storage https://storage.LOCATION.rep.googleapis.com/\n ```\n\n Alternatively, you can set the\n `CLOUDSDK_API_ENDPOINT_OVERRIDES_STORAGE` environment variable to the\n endpoint: \n\n ```\n CLOUDSDK_API_ENDPOINT_OVERRIDES_STORAGE=https://storage.LOCATION.rep.googleapis.com/ gcloud ls gs://my-bucket\n ```\n\n### REST APIs\n\n### JSON API\n\nWhen making requests to regional endpoints, use the following URIs:\n\n- For general JSON API requests, excluding object uploads, use the\n following endpoint, replacing \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e with a supported\n [bucket location](#supported-locations):\n\n ```\n https://storage.LOCATION.rep.googleapis.com\n ```\n\n For example, the following endpoint is used to create a bucket in the\n `ME-CENTRAL2` region: \n\n ```\n https://storage.me-central2.rep.googleapis.com\n ```\n- For JSON API object uploads, use the following endpoint:\n\n ```\n https://storage.LOCATION.rep.googleapis.com/upload/storage/v1/b/BUCKET_NAME/o\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e with a supported [bucket location](#supported-locations).\n\n - \u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e with the name of the bucket to which you want\n to upload an object.\n\n For example, the following endpoint is used to upload an object to\n a bucket in the `ME-CENTRAL2` region: \n\n ```\n https://storage.me-central2.rep.googleapis.com/upload/storage/v1/b/my-example-bucket/o\n ```\n- For JSON API object downloads, use the following endpoint:\n\n ```\n https://storage.LOCATION.rep.googleapis.com/download/storage/v1/b/BUCKET_NAME/o/OBJECT_NAME?alt=media\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e with a supported [bucket location](#supported-locations).\n\n - \u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e with the name of the bucket that\n contains the object you want to download.\n\n - \u003cvar translate=\"no\"\u003eOBJECT_NAME\u003c/var\u003e with the name of the object you want\n to download.\n\n### XML API\n\nWhen making requests to regional endpoints, use the path-style or\nvirtual hosted-style endpoint:\n\n- Path-style endpoint:\n\n ```\n https://storage.LOCATION.rep.googleapis.com/BUCKET_NAME/OBJECT_NAME\n ```\n\n \u003cbr /\u003e\n\n- Virtual hosted-style endpoint:\n\n ```\n https://BUCKET_NAME.storage.LOCATION.rep.googleapis.com/OBJECT_NAME\n ```\n\n \u003cbr /\u003e\n\n Replace:\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e with a supported [bucket location](#supported-locations).\n\n - \u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e with the name of a bucket.\n\n - \u003cvar translate=\"no\"\u003eOBJECT_NAME\u003c/var\u003e with the name of an object.\n\nFor example, the following sample can be used to upload an object to a\nbucket in the `ME-CENTRAL2` region: \n\n```\nhttps://storage.me-central2.rep.googleapis.com/my-example-bucket/my-example-object\n```\n\nRestricting global API endpoint usage\n-------------------------------------\n\nTo help enforce the use of regional endpoints, you can use the\n`constraints/gcp.restrictEndpointUsage` organization policy constraint to block\nrequests to the global API endpoint. For more information, see the\n[Restrict Endpoint Usage](/assured-workloads/docs/restrict-endpoint-usage) documentation."]]
