Powershell Upload, Download file Google Storage Bucket

Today in this article we will see how to automate and perform Powershell Upload, Download file Google cloud Storage Bucket

Updated October 2026: a gsutil vs gcloud storage section, unattended authentication and 403 troubleshooting, and an FAQ.

Today in this article, we will cover below aspects,

Getting Started

Prerequisites

• Create an account in the google cloud project.

• Install the Google Cloud SDK

Above google cloud SDK needs to be installed on the Server or VM where we need to run the target scripts.

Powershell – Upload the File to Google Cloud Storage Bucket

Let’s use the below image(the official logo of the TheCodebuzz) as an example. We shall be uploading this file to the GCP bucket.

Let’s save the above file to the computer in the path C:\test\thecodebuzz.png

Make sure to activate the service account as below by providing the service account file path as below,

gccloud auth activate-service-account --key-file $googleServiceAccount

Command Pattern

gsutil cp [target-file-path] gs://[gcs-path]

Example

try
{  
  #Source file path
  $sourFilePath = "C:\test\CloudBlobTest.pdf"
  #Google Service Account
  $googleServiceAccount = dir "$sourFilePath\google-svc-thecodebuzz.json"
  #Destination path
  $destinationPath = "gs://thecodebuzz/"
  #Activate the google service account
  gccloud auth activate-service-account --key-file $googleServiceAccount
  #Copy files to GCS bucket
  gsutil cp $sourFilePath $destinationPath

}

catch
{

  echo $_.Exception.GetType().FullName,$_.Exception.Message

}

After successful execution of the commands file will be uploaded to the google cloud storage bucket.

Powershell – Download the File to Google Cloud Storage Bucket

We shall now download the above-uploaded file from google Bucket using gsutil command line as below,

Command Pattern

gsutil cp gs://[gcs-file-path] [target-file-path]

Example

try
{  
  #Source file path
  $sourFilePath = "gs://thecodebuzz/load-from-gcutil/thecodebuzz.png"
  #Google Service Account
  $googleServiceAccount = dir "$sourFilePath\google-svc-thecodebuzz.json"
  #Destination path
  $destinationPath = "C:\Test\gcp\Download"
  #Activate the google service account
  gccloud auth activate-service-account --key-file $googleServiceAccount
  #Copy files from GCS bucket
  gsutil cp $sourFilePath $destinationPath 

}

catch
{

  echo $_.Exception.GetType().FullName,$_.Exception.Message

}

Once the command is successful, you shall see the file generated in the path.

Do you have any comments or ideas or any better suggestions to share?

Please sound off your comments below.

Happy Coding !!

References :

• Schedule PowerShell Script using Windows Task Scheduler

Please bookmark this page and share it with your friends. Please Subscribe to the blog to receive notifications on freshly published (2026) best practices and guidelines for software design and development.

Authenticate Unattended Scripts and Fix Common 403 Errors

For scheduled runs, activate a service account with gcloud auth activate-service-account --key-file. Treat that JSON key as a long-lived secret. If the script runs on a Google Cloud VM, an attached service account, impersonation, or workload identity federation avoids downloading a key at all.

In plain English: A service account key is like a spare house key that never expires. Anyone who copies the file can use it until you revoke it. The analogy stops fitting with attached accounts, where there is no key file to copy.

Which IAM role does the script need?

Grant the narrowest role that covers the job, and grant it on the bucket rather than the project. Check these against the current IAM documentation before relying on them.

• roles/storage.objectCreator: upload only. It can’t read, overwrite or delete.
• roles/storage.objectViewer: read and list, which is enough for downloads.
• roles/storage.objectUser or roles/storage.objectAdmin: full object access, for scripts that upload, overwrite and delete.

How do you run this under Windows Task Scheduler?

A scheduled task runs as one specific Windows user, and gcloud stores its configuration and credentials per user. Credentials you activated in your own session won’t exist for the task’s account.

1. Pick the account: note which user the task runs as.
2. Activate inside the script: call the activate command at the top, or run it once while signed in as that user.
3. Log the result: write $LASTEXITCODE to a log file after each gcloud call. A non-zero value is your only reliable failure signal when nobody is watching.

How do you troubleshoot a 403 or a missing command?

Most failures come down to the wrong identity, the wrong role or the wrong name. Work through these checks in order.

• 403 permission denied: run gcloud auth list as the task’s user to see the active account. Then confirm that account holds a role on the bucket that allows the operation. An upload-only role will fail on an overwrite.
• “gcloud is not recognized”: the SDK isn’t on PATH for the account running the script. Restart the shell or the task after installing. Also check the spelling, because the original sample’s gccloud is a typo.
• Wrong project or bucket: confirm the bucket name in the gs:// path and check gcloud config list for the active project.

Frequently asked questions

Should I use gsutil or gcloud storage in PowerShell scripts?

Use gcloud storage for new scripts. Google documents it as GA and the recommended command-line tool for Cloud Storage, and it publishes a gsutil-to-gcloud mapping page. Existing gsutil cp scripts still work as a starting point, but check the mapping for flag and wildcard differences, such as three or more consecutive asterisks being treated as one.

How do I stop gcloud storage cp from overwriting an existing object?

Add --no-clobber (-n), which skips objects that already exist at the destination. Without it, the upload replaces the existing object. For folder uploads, pair it with --continue-on-error (-c) so one failure doesn’t stop the whole batch.

What is the difference between New-GcsObject and Write-GcsObject?

Both are cmdlets in the GoogleCloud PowerShell module (Cloud Tools for PowerShell), but they do different jobs. New-GcsObject uploads a file, or a whole folder with -Folder and an optional -ObjectNamePrefix, as new objects. Write-GcsObject replaces the contents of an object that already exists, and it warns if the object isn’t there. To download an object to disk, use Read-GcsObject with -OutFile.

Why does Read-GcsObject fail with a gs:// path?

A reported issue in the GoogleCloudPlatform/google-cloud-powershell repository says Read-GcsObject doesn’t accept full gs://bucket/path values. Pass -Bucket and -ObjectName separately, or pipe from Get-Item, for example Get-Item gs://bucket/path/object | Read-GcsObject -OutFile .\result. The gcloud storage cp command accepts gs:// URLs directly, so you don’t need this workaround there.

Share on Facebook

Post on X

Follow us

Save