---
title: Configure access
url: /docs/iac/get-started/gcp/configure/
---
## Configure access to Google Cloud

Pulumi's CLI needs access to your Google Cloud account to manage cloud resources.

If you've already [installed](https://cloud.google.com/sdk/docs/install) and [initialized](https://cloud.google.com/sdk/docs/initializing) the gcloud CLI, Pulumi will respect and use your configuration settings.

You must use a Google Cloud account that has rights to deploy and manage resources, such as Cloud Storage buckets.

### Testing access

To test that your Google Cloud access is configured properly, run:

<!-- chooser: os -->
<!-- option: linux -->

```bash
$ gcloud config list
```

<!-- /option -->

<!-- option: windows -->

```powershell
> gcloud config list
```

<!-- /option -->
<!-- /chooser -->

If your active account and project are printed, your configuration is correct. If not, read on:

```
[core]
account = user@example.com
disable_usage_reporting = True
project = my-gcp-project

Your active configuration is: [default]
```

You can also verify your authentication status:

<!-- chooser: os -->
<!-- option: linux -->

```bash
$ gcloud auth list
```

<!-- /option -->

<!-- option: windows -->

```powershell
> gcloud auth list
```

<!-- /option -->
<!-- /chooser -->

### Alternative approaches

If you don't have the gcloud CLI installed, or you plan on using Pulumi in a CI/CD pipeline, you can [create a service account and download a JSON key file](https://cloud.google.com/iam/docs/keys-create-delete). Then set the `GOOGLE_CREDENTIALS` environment variable on your workstation:

<!-- chooser: os -->
<!-- option: linux -->

```bash
$ export GOOGLE_CREDENTIALS="$(cat ~/path/to/service-account-key.json)"
```

<!-- /option -->

<!-- option: windows -->

```powershell
> $env:GOOGLE_CREDENTIALS = (Get-Content -Path "C:\path\to\service-account-key.json" -Raw)
```

<!-- /option -->
<!-- /chooser -->

Alternatively, you can set the path to the key file:

<!-- chooser: os -->
<!-- option: linux -->

```bash
$ export GOOGLE_APPLICATION_CREDENTIALS="$HOME/path/to/service-account-key.json"
```

<!-- /option -->

<!-- option: windows -->

```powershell
> $env:GOOGLE_APPLICATION_CREDENTIALS = "C:\path\to\service-account-key.json"
```

<!-- /option -->
<!-- /chooser -->

> **Note:** Consider using [Pulumi ESC's Google Cloud login support](/docs/esc/integrations/dynamic-login-credentials/gcp-login) for dynamic,
short-lived Google Cloud credentials via OpenID Connect (OIDC) instead of long-lived static credentials. This is a security best practice.

You may need to set your Google Cloud project explicitly:

<!-- chooser: os -->
<!-- option: linux -->

```bash
$ export GOOGLE_PROJECT="<YOUR_PROJECT_ID>"
```

<!-- /option -->

<!-- option: windows -->

```powershell
> $env:GOOGLE_PROJECT = "<YOUR_PROJECT_ID>"
```

<!-- /option -->
<!-- /chooser -->

For detailed information on Pulumi's use of Google Cloud credentials, see [Google Cloud Setup](/registry/packages/gcp/installation-configuration/).

---
[← Previous step](/docs/iac/get-started/gcp/begin/)
[Next: Create project →](/docs/iac/get-started/gcp/create-project/)