[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-17。"],[],[],null,["# Configure your Google Cloud project using the setup application\n\nThis document describes configuring Google Cloud permissions and Cloud Storage\nusing the Appliance Cloud Setup Application.\n\nThe Appliance Cloud Setup Application prompts you for information, such as your\ntransfer session ID, destination Cloud Storage bucket and Cloud Key Management Service\n(Cloud KMS) preferences. Using the information you provide, the\nAppliance Cloud Setup Application configures your Google Cloud permissions, preferred\nCloud Storage bucket, and Cloud KMS key for your transfer.\n\nBefore you begin\n----------------\n\nEnsure that you have the following:\n\n- The name of the project and the business location used for ordering the\n appliance.\n\n- The Appliance ID, session ID, bucket name, bucket prefix, and encryption key\n specified when ordering the appliance. These can be found in the email titled\n **Google Transfer Appliance Prepare Permissions and Storage**.\n\n- The Storage Transfer Service **service agent** listed in the email titled\n **Google Transfer Appliance Prepare Permissions and Storage**. It looks\n similar to the following example:\n\n `project-`\u003cvar translate=\"no\"\u003eTENANT_IDENTIFIER\u003c/var\u003e`@storage-transfer-service.iam.gserviceaccount.com`\n\n In this example, \u003cvar translate=\"no\"\u003eTENANT_IDENTIFIER\u003c/var\u003e is a generated\n number specific to this particular project.\n\n We use Storage Transfer Service to transfer data from the appliance to your\n Cloud Storage bucket.\n\nAssign IAM roles\n----------------\n\nYou must have the correct\n[IAM roles](/iam/docs/understanding-roles) on the project and\nCloud Storage bucket.\n\nIf you are the project owner, `roles/owner` is sufficient. Skip to the next\nsection, [Download the Appliance Cloud Setup Application](#download-permissions-app).\n\nIf you don't have `roles/owner` you must have the following roles:\n\n- `roles/serviceusage.serviceUsageAdmin`: To enable the required APIs in the project.\n- `roles/iam.serviceAccountCreator`: To create new service accounts.\n- `roles/iam.serviceAccountKeyAdmin`: To create and download service account keys. Can be granted at the project level, or can be granted to the Appliance service account once it's been created by the permissions app.\n- `roles/storagetransfer.admin`: To create the Storage Transfer Service service account.\n- `roles/transferappliance.viewer`: To fetch Cloud Storage bucket and Cloud Key Management Service key details.\n- `roles/storage.admin`: Can be granted at the project level if you haven't created a Cloud Storage bucket, or can be granted at the bucket level if you're using an existing Cloud Storage bucket.\n- `roles/cloudkms.admin`: Can be granted at the project level if you haven't created a Cloud KMS key, or can be granted at the key level if you're using an existing Cloud KMS key.\n\n### Viewing roles\n\nTo view IAM roles that your principals have for a project and\nits resources, do the following:\n\n1. In the Google Cloud console, go to the **IAM** page.\n\n [Go to the IAM page](https://console.cloud.google.com/iam-admin/iam)\n2. The page displays all the principals that have IAM roles\n on your project.\n\nDownload the Appliance Cloud Setup Application\n----------------------------------------------\n\nTo download the Appliance Cloud Setup Application:\n\n1. Open the Google Cloud console Welcome page.\n\n [Open the Google Cloud console Welcome page](https://console.cloud.google.com/welcome)\n2. Verify that the name of the project used for the transfer is displayed in\n the project selector. The project selector tells you what project you are\n currently working in.\n\n If you don't see the name of the project you are using for the transfer,\n click the project selector, then select the correct project.\n3. Click Activate Cloud Shell.\n\n4. In Cloud Shell, use the `wget` command to download the Appliance Cloud Setup Application:\n\n wget https://storage.googleapis.com/transferappliance/cloudsetup/ta_cloudsetup_x86_64-linux -O ta_cloudsetup_x86_64-linux\n\nRun the Appliance Cloud Setup Application\n-----------------------------------------\n\nIn Cloud Shell, run the following command to start the Appliance Cloud Setup Application: \n\n chmod 0777 ta_cloudsetup_x86_64-linux && ./ta_cloudsetup_x86_64-linux\n\nThe app walks you through the steps required to configure your project.\n\n### Application output\n\nThe Appliance Cloud Setup Application completes the following actions:\n\n- Grants permissions to the Appliance service accounts used to transfer data to your Cloud Storage bucket.\n- If you chose to use a customer-managed encryption key, grants permission to the Appliance service accounts to access Cloud KMS key data.\n- Displays the following information:\n\n - The **Google Cloud cryptographic key resource name**, if you chose to use a customer-managed Cloud KMS encryption key.\n - The **Google Cloud Cloud Storage destination bucket name**.\n - A **Google Cloud Cloud Storage destination bucket prefix**, if you supplied one.\n - If applicable, the Online Transfer service account name, and the Storage Transfer Service service agent name.\n\nThe information displayed is also stored within the home directory on\nCloud Shell, named \u003cvar translate=\"no\"\u003eSESSION_ID\u003c/var\u003e`-output.txt`,\nwhere \u003cvar translate=\"no\"\u003eSESSION_ID\u003c/var\u003e is the session ID for this\nparticular transfer.\n\nThe names of the service accounts granted permission for this particular\ntransfer are stored within the home directory on Cloud Shell, named\n`cloudsetup.log`.\n\nSend CMEK information to Google\n-------------------------------\n\nIf you specified a customer-managed encryption key, send us the key information\nby completing the form linked from the email titled **Google Transfer Appliance\nPrepare Permissions and Storage**.\n\nDownload service account keys\n-----------------------------\n\nDownload and save a service account key for the Online Transfer Service Account. \n\n```bash\ngcloud iam service-accounts keys create key.json \\\n --iam-account=APPLIANCE_SERVICE_ACCOUNT_EMAIL\n```\n\nThe value of \u003cvar translate=\"no\"\u003eAPPLIANCE_SERVICE_ACCOUNT_EMAIL\u003c/var\u003e is displayed in the\noutput of the permissions app: \n\n ...\n\n Appliance Service Account Name:\n example-sa@example-project.iam.gserviceaccount.com\n\nWhen you receive your appliance, upload the key to the `/tmp` directory on the\nappliance.\n\nTroubleshooting\n---------------\n\n### Error 400: Service account does not exist\n\n**Issue:**\n\nAppliance Cloud Setup Application displays the following message: \n\n```\nService account ta-SESSION_ID@transfer-appliance-zimbru.iam.gserviceaccount.com\ndoes not exist.\n```\n\nWhere \u003cvar translate=\"no\"\u003eSESSION_ID\u003c/var\u003e is the session ID provided to\nAppliance Cloud Setup Application.\n\n**Solution:**\n\nVerify the session ID for your transfer. The session ID is unique to each\ntransfer session and shared by the Transfer Appliance Team. If you haven't\nreceived a session ID, contact [data-support@google.com](mailto:data-support@google.com).\n\n### Error: Listing KMS locations\n\n**Issue:**\n\nAppliance Cloud Setup Application displays the following message: \n\n```\nError: listing kms locations\n```\n\n**Solution:**\n\nDo the following within Cloud Shell:\n\n1. Re-authenticate by running `gcloud auth login`.\n\n2. Retry Appliance Cloud Setup Application.\n\nIf the error persists, contact the Transfer Appliance Team at\n[data-support@google.com](mailto:data-support@google.com).\n\n### Error: Creating Cloud KMS key constraint error\n\n**Issue:**\n\nAppliance Cloud Setup Application displays a message similar to the following: \n\n```\nError: creating cloud kms key violates constraint error: code = FailedPrecondition\ndesc= europe-west6 violates constraint 'constraints/gcp.resourceLocations' on\nthe resource 'projects/test/locations/europe-west6'\n```\n\n**Solution:**\n\nYour Google Cloud project may have organization policies that disallow creating\nCloud Key Management Service keys in certain locations. The following are possible solutions:\n\n- Choose a different location to create the Cloud Key Management Service key.\n- Update the organization policy to allow Cloud Key Management Service key creation in the location you desire.\n\nFor more information see\n[Restricting Resource Locations](/resource-manager/docs/organization-policy/defining-locations)."]]
