Mounting Google Cloud Storage Buckets Locally using Cloud Storage FUSE

Integrating Object Storage directly into a local Linux filesystem allows applications to interact with remote files using standard POSIX operations (like mkdir, cat, ls). Using Cloud Storage FUSE (Filesystem in Userspace), you can mount Google Cloud Storage (GCS) buckets as directories on your Linux Virtual Machines.

This approach is highly effective for database backup automation, media assets pipelines, and logs archiving without refactoring applications to use the Cloud Storage APIs directly.

Here is the exact step-by-step breakdown of how to provision, secure, install, and mount a GCS bucket using FUSE:

• 1. Provision a Secure GCS Bucket
• 2. Assign IAM Service Account Roles
• 3. Install Cloud Storage FUSE
• 4. Create Mount Points and Mount the Bucket
• 5. Test Read, Write, and Delete Operations

1. Provision a Secure GCS Bucket

Before mounting, you must create a GCS bucket. Following security best practices, we will enforce uniform bucket-level access and enable public access prevention (PAP) to ensure the contents of your bucket cannot be accidentally exposed to the public internet.

Using gcloud:

gcloud storage buckets create gs://<BUCKET_NAME> \
  --default-storage-class=STANDARD \
  --location=<LOCATION> \
  --uniform-bucket-level-access \
  --public-access-prevention \
  --project="<PROJECT_ID>"

2. Assign IAM Service Account Roles

For the VM instance to authenticate and connect to your bucket, the Service Account assigned to your VM must be granted appropriate access.

To perform read, write, and delete operations inside the bucket, assign the Storage Object User (roles/storage.objectUser) role to the VM's Service Account.

Using gcloud:

# Grant Storage Object User role to the VM Service Account on the bucket
gcloud storage buckets add-iam-policy-binding gs://<BUCKET_NAME> \
  --member="serviceAccount:<SERVICE_ACCOUNT_EMAIL>" \
  --role="roles/storage.objectUser" \
  --project="<PROJECT_ID>"

3. Install Cloud Storage FUSE

Cloud Storage FUSE needs to be installed on your Linux VM. Here is how you can set it up on Debian and Ubuntu distributions:

If your distribution supports the signed-by option (Modern OS):

Install the required packages:

sudo apt-get update && sudo apt-get install -y curl lsb-release

Add the Cloud Storage FUSE distribution repository source:

export GCSFUSE_REPO=gcsfuse-`lsb_release -c -s`
echo "deb [signed-by=/usr/share/keyrings/cloud.google.asc] https://packages.cloud.google.com/apt $GCSFUSE_REPO main" | sudo tee /etc/apt/sources.list.d/gcsfuse.list

Import the Google Cloud public key:

curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo tee /usr/share/keyrings/cloud.google.asc

If your distribution is outdated (No signed-by support):

Add the repository source:

export GCSFUSE_REPO=gcsfuse-`lsb_release -c -s`
echo "deb https://packages.cloud.google.com/apt $GCSFUSE_REPO main" | sudo tee /etc/apt/sources.list.d/gcsfuse.list

Import the Google Cloud public key:

curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -

Run FUSE Installation:

Once the repository is configured, update your package cache and install gcsfuse:

sudo apt-get update
sudo apt-get install -y gcsfuse

4. Create Mount Points and Mount the Bucket

With FUSE installed, you can now create a directory on the local filesystem and map it to your GCS bucket.

Using the terminal:

# Create the local mount directory
sudo mkdir -p /gcsbackup

# Update folder ownership so non-root users can write to it
sudo chown -R <VM_USER>:<VM_GROUP> /gcsbackup

# Mount the GCS bucket locally
gcsfuse <BUCKET_NAME> /gcsbackup

To verify that the bucket was successfully mounted, list active mounts using df -h:

df -h

You should see a filesystem entry matching your bucket name mounted under /gcsbackup.

5. Test Read, Write, and Delete Operations

Now that the bucket is mounted, let's navigate to the directory and perform read and write tests:

# Navigate to mount point
cd /gcsbackup/

# Create a test subdirectory
mkdir db-vm-mysql && cd db-vm-mysql/

# Write dummy data to a test file
cat /dev/urandom | head -c 1024 >> testfile
ls -lah

# Write another test file
cat /dev/urandom | head -c 1024 >> testfile1
ls -la

# Delete a test file
rm testfile1
ls -la

FUSE automatically synchronizes all changes with the underlying Google Cloud Storage bucket in real-time. Any file created under /gcsbackup/ will immediately appear as an object in your GCS bucket.