Within Pub/Sub, a topic is a named resource that represents a feed of messages. You must create a topic before you can publish or subscribe to it. Pub/Sub supports two kinds of topics: a standard topic and an import topic.
This document describes how to create a Pub/Sub standard topic. If you want to learn more about an import topic and how to create one, see About import topics.
To create a topic you can use the Google Cloud console, the Google Cloud CLI, the client library, or the Pub/Sub API.
Before you begin
Learn about the Pub/Sub service and its terminology.
Learn about the publish process.
Required roles and permissions to manage topics
To get the permissions that you need to create and manage topics,
ask your administrator to grant you the
Pub/Sub Editor(roles/pubsub.editor
)
IAM role on your topic or project.
For more information about granting roles, see Manage access to projects, folders, and organizations.
This predefined role contains the permissions required to create and manage topics. To see the exact permissions that are required, expand the Required permissions section:
Required permissions
The following permissions are required to create and manage topics:
-
Create a topic:
pubsub.topics.create
-
Delete a topic:
pubsub.topics.delete
-
Detach a subscription from a topic:
pubsub.topics.detachSubscription
-
Get a topic:
pubsub.topics.get
-
List a topic:
pubsub.topics.list
-
Publish to a topic:
pubsub.topics.publish
-
Update a topic:
pubsub.topics.update
-
Get the IAM policy for a topic:
pubsub.topics.getIamPolicy
-
Configure the IAM policy for a topic:
pubsub.topics.setIamPolicy
You might also be able to get these permissions with custom roles or other predefined roles.
You can configure access control at the project level and at the individual resource level. You can create a subscription in one project and attach it to a topic located in a different project. Ensure that you have the required permissions for each project.
Properties of a topic
When you create or update a topic, you must specify its properties.
Add a default subscription
Adds a default subscription to the Pub/Sub topic. You can create another subscription for the topic after the topic is created. The default subscription has the following properties:
- Subscription ID of
-sub
- Pull delivery type
- Message retention duration of seven days
- Expiration after 31 days of inactivity
- Acknowledgment deadline of 10 seconds
- Immediate retry policy
Use a schema
A schema is a format that the message data field must follow. A schema is a contract between the publisher and subscriber that Pub/Sub enforces. Topic schemas help standardize message types and permissions to allow them to be consumed by different teams in your organization. Pub/Sub creates a central authority for message types and permissions. To create a topic with schema, see Schema overview.
Enable ingestion
Enabling this property lets you ingest streaming data from external sources into a topic so that you can use the features of Google Cloud. To create an import topic for ingestion, see the following:
Enable message retention
Specifies how long the Pub/Sub topic retains messages after publication. After the message retention duration is over, Pub/Sub might discard the message regardless of its acknowledgment state. Message storage fees are charged for storing all messages published to the topic
- Default = Not enabled
- Minimum value = 10 minutes
- Maximum value = 31 days
Export message data to BigQuery
Enabling this property lets you create a BigQuery subscription that writes messages to an existing BigQuery table as they are received. You don't need to configure a separate subscriber client. For more information about BigQuery subscriptions, see BigQuery subscriptions.
Export message data to Cloud Storage
Enabling this property lets you create a Cloud Storage subscription that writes messages to an existing Cloud Storage table as they are received. You don't need to configure a separate subscriber client. For more information about Cloud Storage subscriptions, see Cloud Storage subscriptions.
Google-managed encryption key
Specifies that the topic is encrypted using Google-managed encryption keys. Pub/Sub encrypts messages with Google-managed keys by default, so choosing this option maintains the default behavior. Google handles key management and rotation automatically, ensuring your messages are always protected with the strongest available encryption. This option requires no further configuration. For more information about Google-managed encryption keys, see Default encryption with Google-owned and Google-managed keys.
Cloud KMS key
Specifies if the topic is encrypted with a customer-managed encryption key (CMEK). Pub/Sub encrypts messages with Google-owned and Google-managed keys by default. If you specify this option, Pub/Sub uses the envelope encryption pattern with CMEK. In this approach, Cloud KMS does not encrypt the messages. Instead, Cloud KMS encrypts the Data Encryption Keys (DEKs) that Pub/Sub creates for each topic. Pub/Sub encrypts the messages using the newest DEK that was generated for the topic. Pub/Sub decrypts the messages shortly before they are delivered to subscribers. For more information about creating a key, see Configure message encryption.
Create a topic
Create a topic before you can publish or subscribe to it.
Console
To create a topic, follow these steps:
In the Google Cloud console, go to the Pub/Sub Topics page.
Click Create topic.
In the Topic ID field, enter an ID for your topic. For more information about naming topics, see the naming guidelines.
Retain the option Add a default subscription.
Optional. Do not select the other options.
Click Create topic.
gcloud
-
In the Google Cloud console, activate Cloud Shell.
At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.
-
To create a topic, run the
gcloud pubsub topics create
command:gcloud pubsub topics create TOPIC_ID
To create a topic, use the
The request must be authenticated with an access token in the
Where: Response:REST
projects.topics.create
method:Authorization
header. To obtain an access token for the current
Application Default Credentials: gcloud auth application-default print-access-token
.
PUT https://pubsub.googleapis.com/v1/projects/PROJECT_ID/topics/TOPIC_ID
Authorization: Bearer ACCESS_TOKEN
{
"name": "projects/PROJECT_ID/topics/TOPIC_ID"
}
Before trying this sample, follow the C++ setup instructions in the
Pub/Sub quickstart using
client libraries.
For more information, see the
Pub/Sub C++ API
reference documentation.
To authenticate to Pub/Sub, set up Application Default Credentials.
For more information, see
Set up authentication for a local development environment.
Before trying this sample, follow the C# setup instructions in the
Pub/Sub quickstart using
client libraries.
For more information, see the
Pub/Sub C# API
reference documentation.
To authenticate to Pub/Sub, set up Application Default Credentials.
For more information, see
Set up authentication for a local development environment.
Before trying this sample, follow the Go setup instructions in the
Pub/Sub quickstart using
client libraries.
For more information, see the
Pub/Sub Go API
reference documentation.
To authenticate to Pub/Sub, set up Application Default Credentials.
For more information, see
Set up authentication for a local development environment.
Before trying this sample, follow the Java setup instructions in the
Pub/Sub quickstart using
client libraries.
For more information, see the
Pub/Sub Java API
reference documentation.
To authenticate to Pub/Sub, set up Application Default Credentials.
For more information, see
Set up authentication for a local development environment.
Before trying this sample, follow the PHP setup instructions in the
Pub/Sub quickstart using
client libraries.
For more information, see the
Pub/Sub PHP API
reference documentation.
To authenticate to Pub/Sub, set up Application Default Credentials.
For more information, see
Set up authentication for a local development environment.
Before trying this sample, follow the Python setup instructions in the
Pub/Sub quickstart using
client libraries.
For more information, see the
Pub/Sub Python API
reference documentation.
To authenticate to Pub/Sub, set up Application Default Credentials.
For more information, see
Set up authentication for a local development environment.
Before trying this sample, follow the Ruby setup instructions in the
Pub/Sub quickstart using
client libraries.
For more information, see the
Pub/Sub Ruby API
reference documentation.
To authenticate to Pub/Sub, set up Application Default Credentials.
For more information, see
Set up authentication for a local development environment.
C++
C#
Go
Java
Node.js
Node.js
PHP
Python
Ruby
Organization policy constraints
Organizational policies can restrict topic creation, for example, a policy can restrict message storage in a Compute Engine region. To avoid topic creation errors, examine and update organizational policies, as needed, before creating a topic.
If your project is newly created, wait a few minutes for the organization policy to initialize before creating a topic.
For more information, see Configure message storage policies.
What's next
Choose the type of subscription for your topic.
Learn how to publish a message to a topic.
Create or modify a topic with gcloud CLI, REST APIs, or Client libraries.