Cloud Storage Buckets
A bucket connection lets Mycorr read CSV, TSV and Parquet files (.csv, .tsv, .parquet, .pq) from Google Cloud Storage and import each one as a table. Amazon S3 and Azure Blob Storage aren't supported yet.
Add a bucket connection
Open Connections → Add connection and pick the bucket type. Give it a Name, then choose a Method:
| Method | How it works | Use it when |
|---|---|---|
| Sign in with Google (default) | Mycorr reads the bucket with your own Google account's access. Nothing to set up in GCP. | You can already read the bucket with your Google account. One specific bucket per connection. |
| Workload Identity | Your GCP admin lets Mycorr exchange your Google sign-in for a short-lived token, under rules they control in IAM. | Your organization manages access centrally, or you want a whole project rather than one bucket. See GCP Setup. |
Then:
- Choose the Access scope: Single bucket (recommended; enter the Bucket name) or Entire project (Workload Identity only).
- Click Sign in with Google and approve. The consent screen asks to see your Cloud Storage data read-only, plus your name and email.
- With Workload Identity, paste the WIF audience your admin gave you. Copy Mycorr client ID gives your admin the value their setup needs.
- Click Test & save.
Import files
Inside a model, open Import → Connections and expand the connection. Buckets and folders open as a tree; Search buckets narrows it down. Drag a file onto the canvas to import it as a table. A file that is Already imported in this model is marked, and other file types show Format not yet supported.
The table stays linked to its file. It is read-only in Mycorr: when the file changes, choose Sync from bucket from the table's menu. See Syncing for how a sync handles rows and columns.
Security
- No stored keys. Mycorr never asks for a service-account key. Access comes from your Google sign-in, exchanged for a short-lived token when Mycorr reads.
- Read-only. The Google scope is read-only, and with Workload Identity the IAM roles are
storage.objectViewer(plusstorage.bucketViewerfor a whole project). Mycorr can't change or delete anything in your bucket. - Audited. With Workload Identity, every read shows in Cloud Audit Logs under the signed-in person's identity.
Revoking
- In Mycorr: delete the connection on the Connections page. Its tables keep their data but stop syncing.
- In Google: remove Mycorr under your Google account's third-party access, or, with Workload Identity, remove the IAM binding or the provider. See GCP Setup → Revoking access.
Troubleshooting
| Message | Fix |
|---|---|
| "Browser blocked the popup" | Allow pop-ups for Mycorr and click Sign in with Google again. |
| "Permission denied by cloud storage…" | The account or federated identity can't read the bucket. Grant roles/storage.objectViewer on it. |
| "Bucket or path not found…" | Check the bucket name and that the file still exists. |
| "This table's bucket connection is missing…" | The connection was deleted. Add it again on the Connections page, then sync. |