Skip to main content

GCS as Private Data Storage

Follow this guide to configure your Alteryx One Platform workspace to replace Alteryx Data Storage (ADS) with an instance of Google Cloud Storage (GCS) that you own.

Note

In the future, organizations that want to apply their own authentication security policies to individual workspaces can enable Single-Sign On on a workspace-by-workspace basis. Currently, Google Service Accounts provisions Google Cloud Storage as Alteryx Private Data Storage in Workspace Mode. Workspace Mode enables all users to access the data assets they create, maintain, and use on the Alteryx One workspace. Users can change the default upload and output paths for all data assets they work with in the Default Bucket. This enables all users on the workspace to access GCP storage and execute credential passthrough to other compatible connections.

Limitations

Connectivity

  • No connectivity to Amazon Redshift.

  • Workspaces provisioned with GCS as Private Date Storage don't support Snowflake Connections.

  • For Google Cloud Platform (GCP), Alteryx One only allows 1 GCP project per workspace with pushdown to the same Big Query connection (with the same project and service account).

Engine Availability

  • Workspaces provisioned with GCS as Private Date Storage don't support EMR Spark as an engine or re-sampling capabilities.

  • Alteryx engines don't support job runtimes greater than 1 hour.

Platform

  • Once you set up GCS as Private Data Storage, you can't switch between Private Data Storage options (for example, GCS to S3).

  • Workspaces provisioned with GCS as Private Date Storage don't support Machine Learning.

Prerequisites

  • Be a user on a Professional or Enterprise Alteryx One plan.

  • Have a Workspace Admin role assigned to you in Alteryx One.

  • Have administrative access to the target GCP project.

  • Have a GCS bucket created in GCP.

Google Cloud Storage on Alteryx One Setup Guide

To set up GCS as private data storage, first you must choose which GCS authentication method you want to use. Then, enable GCS as private data storage in your workspace.

Configure GCS Authentication

Establish a secure connection between Alteryx One and your GCS location. You have 2 options to authenticate GCS for your private data storage...

  • Cloud Authorization: Use Cloud Authorization to leverage your Google IAM to fetch on-demand scoped user credentials for accessing Google Storage.

  • Service Account Key: Service Account Keys authenticate applications, scripts, or services with Google APIs. Alteryx One uses the service account to fetch workspace-level credentials using a Google Service Account.

Cloud Authorization

Step 1: Set Up Single Sign-On (SSO)

Follow the Google Cloud Platform SSO Setup Guide (OIDC) to configure SSO for your workspace.

Step 2: Configure Internal GCP Application

  1. Go to APIs & Services in the GCP console.

  2. Go to the OAuth consent screen.

  3. Select Internal and then select Create.

  4. In the Name field, enter a name for your app. For example, the name of your workspace.

  5. Under Authorized Domains, select Add Domain and then enter alteryxcloud.com.

  6. Select Save and Continue.

  7. Add these scopes:

    openid

    https://www.googleapis.com/auth/userinfo.email

    https://www.googleapis.com/auth/userinfo.profile

    https://www.googleapis.com/auth/devstorage.read_write

    https://www.googleapis.com/auth/bigquery

  8. Select Register.

  9. Select Credentials.

  10. Select Create Credentials and then choose OAuth client ID.

  11. Select Web Application from the Application type dropdown.

  12. In the Name field, enter a name for your app. For example, the name of your workspace.

  13. Under Authorized Redirect URLs, select the Add URI button and then enter the production and test Callback URL. Follow this template…

    1. Production: https://{platformEnvironment}/workspace/${workspaceName}/sso/googleCallback

    2. Test: https://{platformEnvironment}/workspace/test/${workspaceName}/sso/googleCallback.

    3. For example...

      https://us1.alteryxcloud.com/workspace/YOUR-WORKSPACE-NAME/sso/googleCallback
https://us1.alteryxcloud.com/workspace/test/YOUR-WORKSPACE-NAME/sso/googleCallback

    Note

    These changes might take a few minutes to take effect.

  14. Select Save.

  15. Note and copy your Client ID and Client Secret. You will use these later in Step 3.

Step 3: Configure Cloud Authorization on Alteryx One

  1. Return to your Alteryx One workspace.

  2. Go to Profile menu > Workspace Admin > Storage and Processing > Cloud Authorization and then select Google Cloud Platform.

  3. Enter the GCP Client ID you copied in Step 2 after creating credentials in the GCP console.

  4. Enter the GCP Client Secret you copied in Step 2 after creating credentials in the GCP console.

  5. Select Save.

  6. Alteryx One directs you to sign out and then sign back in before proceeding.

Service Account Key

  1. Go to the Google Cloud Console and then sign in with your Google account.

  2. If you have an existing project, select the project where you want to create the Service Account Key. If you don't have a project, create a project now.

  3. On the left pane, select IAM & Admin and then select Service Accounts.

  4. Select Create Service Account.

  5. Enter Service Account Details:

    1. Enter a name for your service account.

    2. [Optional] Enter a description. For example, the name of your Alteryx One workspace.

    3. Choose a role for the service account. For example, Project > Editor or specific API roles depending on your needs. Note that Alteryx One requires these permissions:

      storage.buckets.get

      storage.buckets.list

      storage.objects.create

      storage.objects.delete

      storage.objects.get

      storage.objects.list

    4. Select Continue.

  6. In the Keys section, select Create Key and then select the JSON key type.

  7. Select the JSON key type and then select Create. The private key automatically generates and downloads to your computer. You will use this key later in Step 2.

    Caution

    Keep the JSON key file secure as it provides access to your service account.

Set Up GCS as Private Data Storage

  1. Sign in to your Alteryx One workspace.

  2. Go to Profile menu > Workspace Admin > Storage and Processing > Storage and then select Google Cloud Storage.

  3. If you created a Service Account Key, under Service Account Key, copy and paste the entire JSON key you created previously. Skip this step if you set up Cloud Authorization.

  4. Under Default Bucket, enter the GCS bucket name.

  5. [Optional] Enter a Project ID. Note that this overrides the project ID from the Service Account Key.

  6. Select Save to provision your Alteryx One workspace with GCS as Private Data Storage.

Note

Alteryx One automatically creates a default path when a user signs in to a workspace for the first time after GCS has been set up as the base storage.

Enable Signed URL Transfers for Alteryx One

Allow Alteryx One to generate and use signed URLs for downloads or uploads. Features such as Agents and Insights leverage signed URLs to optimize file transfer performance.

The service account used to generate a signed URL must have permission to perform the operation that the URL allows.

Depending on the required access, you can assign these predefined Google Cloud roles or create a custom role with equivalent permissions:

  • Storage Object Creator (roles/storage.objectCreator) for upload-only access.

  • Storage Object Viewer (roles/storage.objectViewer) for download-only access.

  • Storage Object Admin (roles/storage.objectAdmin) for upload, download, overwrite, and delete access.

  • A role that includes storage.buckets.get, such as Storage Bucket Viewer (roles/storage.bucketViewer), for bucket validation.

The applicable permissions include:

  • storage.objects.create

  • storage.objects.get

  • storage.objects.delete

  • storage.buckets.get

These signed URL permissions supplement the permissions already required to use GCS as Private Data Storage.

Note

If your configuration uses service account impersonation or the IAM Credentials API to generate signed URLs, grant the identity that generates the URLs the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the signing service account.

This role provides the iam.serviceAccounts.signBlob permission.

This additional role isn't required when Alteryx One signs URLs with the private key in the Service Account Key JSON file.

Enable CORS for Signed URL Transfers from a User's Browser

Use this optional setup to allow transfer directly between a user's browser and Google Cloud Storage. It depends on Signed URL Transfers being enabled (see Enable Signed URL Transfers for Alteryx One above).

Configure Cross-Origin Resource Sharing (CORS) on the Default Bucket to allow requests from the Alteryx One environment.

Create a JSON file named cors-config.json with this configuration:

[
  {
    "origin": [
      "https://{platformEnvironment}"
    ],
    "method": [
      "GET",
      "PUT",
      "POST",
      "HEAD",
      "DELETE"
    ],
    "responseHeader": [
      "Content-Type",
      "Content-Length",
      "Content-Range",
      "x-goog-resumable",
      "Location",
      "Range",
      "x-goog-generation",
      "x-goog-metageneration",
      "ETag"
    ],
    "maxAgeSeconds": 3600
  }
]

Replace {platformEnvironment} with the origin of your Alteryx One environment. For example:

https://us1.alteryxcloud.com

Enter only the origin. Don’t include a workspace name, workspace path, or trailing slash.

Apply the CORS configuration to the Default Bucket with one of these commands.

  • Using gcloud:

    gcloud storage buckets update gs://{defaultBucket} --cors-file=cors-config.json

  • Using gsutil:

    gsutil cors set cors-config.json gs://{defaultBucket}

Replace {defaultBucket} with the name of the GCS bucket configured as the Default Bucket in Alteryx One.

Note

Without the required CORS configuration, browser-based uploads and downloads that use signed URLs might fail with a CORS error.

Change Upload and Output Directory Locations

Users can update their workspace preferences to a target Output and Upload location in the provisioned Default Bucket. To change location preferences, follow these steps:

  1. Sign in to your Alteryx One workspace.

  2. Go to Profile menu > Preferences > Storage.

  3. Select Edit next to the Output or Upload directory. You can also create new directories within the Default Bucket.

    Note

    By default, the upload directory is gs://${defaultBucket}/${workspaceId}/${personId}/uploads and the output directory is gs://${defaultBucket}/${workspaceId}/${personId}/queryResults.

Browse Datasets from Google Cloud Storage on Alteryx One

After enabling GCS as a Private Data Storage, users can browse and import datasets from the Default Bucket provisioned by the Admin. To browse data, follow these steps:

  1. Sign in to your Alteryx One workspace.

  2. Go to the Data page.

  3. Select Import Data. On the left pane, you should see Google Cloud Storage as an Import Data option.

  4. Select Google Cloud Storage to access your data.

VPC Service Controls for Private Data Storage

When configuring Private Data Storage with a GCS bucket with VPC Service Controls enabled, add the Alteryx data plane Google Cloud project to your VPC Service Controls service perimeter. Without this configuration, Alteryx services may be unable to access the storage bucket.

Alteryx Data Plane GCP Projects

Add the appropriate Alteryx data plane project number for your deployment region to the VPC Service Controls perimeter.

Region

GCP Region

Control Plane Project

GCP Project Number

us1

us-west1

c-us-w1-p00002

774973207721

eu1

europe-west3

c-eu-w3-p00003

180689404527

au1

australia-southeast1

c-au-se1-p00004

530857852645

Add Alteryx Project to VPC Service Controls Perimeter

  1. Go to the Google Cloud Console and sign in with your Google account.

  2. Go to Security > VPC Service Controls.

  3. Select the service perimeter that protects your GCS bucket and select Edit Perimeter.

  4. Under Resources, select Add Projects.

  5. Add the Alteryx data plane project number for your deployment region and select Save.

In this section: