Google Cloud Storage

GCS occupies the same tier as S3 for agent workloads but with a different ergonomic profile. The JSON API is more agent-friendly than S3's XML-first REST interface — responses are JSON by default, no SDK wrapping required for clean consumption. Service account authentication via JSON key files is conceptually simpler than IAM access key pairs, though the key file itself is a larger secret to manage. Uniform bucket-level access (the recommended mode) eliminates ACL complexity. Storage classes (Standard, Nearline, Coldline, Archive) with automatic lifecycle transitions let agents optimize cost without manual tiering. The Google Cloud client libraries are well-maintained across Python, Node, Go, and Java.

Service account JSON key files are the standard agent credential. Each key file contains a private key, client email, and project ID — one file, one identity. IAM roles (storage.objectViewer, storage.objectAdmin, etc.) provide clean permission scoping. Uniform bucket-level access mode disables per-object ACLs, simplifying the permission model significantly. Workload Identity Federation can eliminate key files entirely for agents running on supported platforms. Signed URLs use HMAC keys or service account signing. The main friction: service account key rotation requires distributing new JSON files, and there's no built-in rotation mechanism. VPC Service Controls add network-level isolation for sensitive buckets.

GCS offers two API surfaces: the JSON API (recommended) and an XML API (S3-compatible, for migration). The JSON API uses clean resource-oriented URLs: storage.googleapis.com/storage/v1/b/{bucket}/o/{object}. List operations support prefix filtering, delimiter-based hierarchy, and pageToken pagination. Resumable uploads handle large objects with automatic retry — more ergonomic than S3's multipart upload protocol. Compose operations can concatenate up to 32 objects server-side, useful for agents assembling outputs. Signed URLs support V4 signing with configurable expiry. The object metadata model supports custom key-value pairs, enabling agents to tag stored artifacts with provenance or workflow state.

JSON API errors return structured responses with error.code, error.message, and error.errors[] array — significantly more debuggable than S3's XML error bodies. 429 Too Many Requests includes Retry-After headers for rate-limited operations. 403 responses distinguish between permission denied and account-level issues better than S3. 404 on missing objects is clean. GCS guarantees strong consistency for all operations (reads after writes, list after write/delete). Rate limits are per-project with published defaults: 1 request per second for bucket operations, effectively unlimited for object operations at normal scale. Cloud Audit Logging provides operation-level tracing.

Documentation is comprehensive and better organized than AWS's equivalent. The quickstart guides, how-to guides, and API reference are cleanly separated. Client library documentation includes idiomatic examples — the Python google-cloud-storage library docs are particularly strong. gsutil CLI is excellent for interactive exploration and scripting. The REST API reference includes 'Try this API' interactive panels. Cloud Console provides a usable bucket browser. Documentation for advanced features (notifications, lifecycle rules, retention policies) is thorough. The main gap for agents: documentation assumes Google Cloud context (projects, billing accounts) which adds onboarding friction for teams not already in the GCP ecosystem.