Bucket
Bucket
Declares a managed Cloud Storage bucket.
Creates a Cloud Storage bucket and configures its visibility (public/private), storage class, and region. When content processors are enabled it also provisions the surrounding pipeline — a Cloud Run processor service, a Pub/Sub topic, a bucket notification, and an Eventarc trigger — so uploaded objects are processed on ingestion.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as a Bucket so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant Bucket. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, project) are read by the engine to resolve this manifest's identity and its parent Project in the dependency graph. |
| spec | Spec | Desired bucket configuration. The authoritative, user-authored specification for this bucket. See Spec. |
Spec
User-authored bucket configuration.
Declares the bucket's visibility, location, storage class, event notifications, and optional serverless content processors. Governs both core bucket topology and event-driven automation.
| Property | Type | Description |
|---|---|---|
| public | bool | Grant unauthenticated public read access. When true, the executor adds an IAM binding granting roles/storage.objectViewer to allUsers, making objects readable without authentication (e.g. for serving through a load balancer backend bucket). |
| description | string | Human-readable description of the bucket. Optional free text describing this bucket's purpose. Set as the bucket's description (falling back to a generated default) and used as context by AI assistants when reasoning about the manifest. |
| notifications | list of BucketNotificationConfig | Object-event notification targets. Pub/Sub topics and events emitted for this bucket. The validator requires each referenced topic to exist as a PubSub manifest under the same parent Project, and the values are reflected into computed.notifications. NOTE: the executor does not yet provision these standalone notifications directly — bucket notifications are currently created only as part of the processor pipeline. See BucketNotificationConfig. |
| scanForMalware | bool | Enable anti-malware scanning of uploads. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: run integrated anti-malware scanning on objects as they are uploaded. |
| processors | Processors | Serverless content processors. See Processors. When set with at least one processor enabled, drives creation of the asynchronous processing pipeline attached to bucket writes. |
| region | string | Bucket location. Geographic location where the bucket and its data reside, controlling data residency. When omitted, the computer falls back to the region inherited from the parent Project. |
| storageClass | string | Default storage class for objects. One of STANDARD, NEARLINE, COLDLINE, or ARCHIVE, trading retrieval latency against cost. Validated against that set and resolved into computed.storage_class. NOTE: the executor currently hardcodes STANDARD when creating the bucket, so this value is not yet applied to provisioning. |
Processors
Serverless processing pipeline for uploaded objects.
When any processor is enabled, the executor provisions a Cloud Run processor service (plus a dedicated service account, Pub/Sub topic, bucket notification, and Eventarc trigger) that runs on each object-finalize event. The whole Processors block is serialized to JSON and passed to the service as its APP_CONFIG.
| Property | Type | Description |
|---|---|---|
| obscenityScanner | bool | Scan uploads for explicit content. When true, objects uploaded to the bucket are scanned for adult or violent content via the Google Cloud Vision API by the provisioned processor service. |
| converters | list of BucketImageConverterConfig | Image transformation and format conversion rules. List of conversions the processor service applies to uploaded images (e.g. resizing or format changes). See BucketImageConverterConfig. |
BucketNotificationConfig
Links storage buckets to Pub/Sub notification pipelines.
Generates the google_storage_notification resource to push event records upon object changes.
| Property | Type | Description |
|---|---|---|
| topic | string | Destination Pub/Sub topic. Name of the PubSub manifest that receives object-change notifications for this bucket. Validated by the bucket validator to reference an existing topic, and collected into the bucket's computed notification list. |
| events | list of string | Object events that trigger a notification. List of storage event types (OBJECT_FINALIZE for new objects, OBJECT_METADATA_UPDATE for metadata changes) that fire a notification. Constrained to those two values by buf.validate; intended to become the event_types of the underlying google_storage_notification. |
BucketImageConverterConfig
Automatic image conversion settings for a bucket.
NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads these fields). Intended future behavior: instruct the bucket's image-processing pipeline how to re-encode and resize uploaded images.
| Property | Type | Description |
|---|---|---|
| format | string | Target output format. Image format uploaded objects are re-encoded to (WEBP, PNG, or JPEG). Constrained by buf.validate. |
| maxWidth | int64 | Maximum output width in pixels. Upper bound on the converted image width; larger images are scaled down. Must be at least 100 (buf.validate). |
| maxHeight | int64 | Maximum output height in pixels. Upper bound on the converted image height; larger images are scaled down. Must be at least 100 (buf.validate). |