이 페이지에서는 리전 엔드포인트를 사용하여 Cloud Storage의 리소스에 액세스하는 방법을 설명합니다. 리전 엔드포인트를 사용하면 데이터 상주 및 데이터 주권 요구사항을 준수하는 방식으로 워크로드를 실행할 수 있으며, 여기서 요청 트래픽은 엔드포인트에 지정된 리전으로 직접 라우팅됩니다.
개요
리전 엔드포인트는 영향을 받는 리소스가 엔드포인트에서 지정된 위치에 있는 경우에만 요청 처리를 허용하는 요청 엔드포인트입니다. 예를 들어 버킷 삭제 요청에서 엔드포인트 https://storage.me-central2.rep.googleapis.com을 사용하는 경우 버킷이 ME-CENTRAL2에 있는 경우에만 요청이 진행됩니다.
리소스가 있는 곳과 다른 위치에서 요청을 처리할 수 있는 전역 엔드포인트와 달리 리전 엔드포인트는 리소스가 있는 엔드포인트에서 지정한 위치 내에서 요청이 처리되도록 보장합니다. 리전 엔드포인트는 인터넷, 기타Google Cloud 리소스(예: Compute Engine 가상 머신), VPN 또는 Interconnect를 사용하는 온프레미스 서비스 및 Virtual Private Cloud(VPC)에서 수신된 요청에 대해 엔드포인트에서 지정된 위치에서 TLS 세션을 종료합니다.
리전 엔드포인트는 객체의 저장 데이터와 전송 중 데이터가 엔드포인트에서 지정된 위치 외부로 이동하지 않도록 하여 데이터 상주를 보장합니다. 이렇게 하면 객체 이름 및 버킷 IAM 정책과 같은 리소스 메타데이터가 제외됩니다. 자세한 내용은 서비스 데이터 참고사항을 참조하세요.
리전 엔드포인트는 엔드포인트로 지정된 위치 내의 리소스에 액세스하거나 이를 변형하는 작업을 수행하는 데만 사용할 수 있습니다. 리전 엔드포인트는 엔드포인트로 지정된 위치 외부의 리소스에 액세스하거나 이를 변형하는 작업을 수행하는 데 사용할 수 없습니다.
예를 들어 리전 엔드포인트 https://storage.me-central2.rep.googleapis.com을 사용하는 경우 ME-CENTRAL2에 있는 버킷의 객체를 읽고 두 버킷 모두 ME-CENTRAL2에 있는 경우에만 소스 버킷에서 대상 버킷으로 객체를 복사할 수 있습니다. ME-CENTRAL2 외부에서 객체를 읽거나 복사하려고 하면 오류가 발생합니다.
엔드포인트가 지정한 위치에 저장된 리소스에서 작업을 수행하는 한 리전 엔드포인트를 사용하여 지원되는 버킷, 객체, 인벤토리 보고서 작업을 수행할 수 있습니다.
Cloud Storage에서 지원되는 전체 작업 목록을 보려면 지원되는 작업 섹션을 펼치세요.
지원되는 작업
객체 작업
객체 만들기
객체 작성
객체 복사1
객체 삭제
객체 메타데이터 가져오기2
객체 나열
객체 패치
객체 재작성1
객체 업데이트 중
버킷 작업
버킷 만들기
버킷 삭제
버킷 메타데이터 가져오기2
버킷 나열
버킷 보관 정책 잠금
버킷 패치
버킷 업데이트
IAM 정책에 대한 작업
버킷 IAM 정책 가져오기2
버킷 IAM 정책 업데이트2
버킷 IAM 정책 테스트2
ACL에서의 작업
객체 ACL 만들기2
버킷의 기본 객체 ACL 만들기2
객체 ACL 삭제2
버킷의 기본 객체 ACL 삭제2
객체 ACL 가져오기2
버킷의 기본 객체 ACL 가져오기2
객체 ACL 나열2
버킷의 기본 객체 ACL 나열2
객체 ACL 패치2
버킷의 기본 객체 ACL 패치2
객체 ACL 업데이트2
버킷의 기본 객체 ACL 업데이트2
Storage Insights 작업
인벤토리 보고서 구성 만들기
인벤토리 보고서 구성 삭제
인벤토리 보고서 얻기
인벤토리 보고서 구성 가져오기
인벤토리 보고서 나열
인벤토리 보고서 구성 나열
인벤토리 보고서 구성 패치
1이 작업은 소스 및 대상 버킷이 엔드포인트에서 지정한 위치에 있는 경우에만 성공합니다.
2이 작업은 메타데이터에 액세스하거나 메타데이터를 변형합니다. 이 작업에 데이터 상주 및 데이터 주권 요구사항 준수가 보장되지는 않습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["# Regional endpoints\n\nThis page describes how to use regional endpoints to access resources in\nCloud Storage. Using regional endpoints lets you run your\nworkloads in a manner that complies with [data residency](/assured-workloads/docs/data-residency) and data\nsovereignty requirements, where your request traffic is routed directly to the\nregion specified in the endpoint.\n\nOverview\n--------\n\nRegional endpoints are request endpoints that only allow requests to proceed if\nthe affected resource exists in the location specified by the endpoint. For\nexample, when you use the endpoint\n`https://storage.me-central2.rep.googleapis.com` in a delete bucket request,\nthe request only proceeds if the bucket is located in `ME-CENTRAL2`.\n\nUnlike global endpoints, where requests can be processed in a different\nlocation from where the resource resides, regional endpoints guarantee that your\nrequests are processed only within the location specified by the endpoint where\nthe resource resides. Regional endpoints terminate TLS sessions in the location\nspecified by the endpoint for requests received from the Internet, other\nGoogle Cloud resources (such as Compute Engine virtual machines), on-premise\nservices using VPN or Interconnect, and Virtual Private Clouds (VPCs).\n\nRegional endpoints guarantee data residency by ensuring that your\nobject's data at rest and in transit does not get moved out of the location\nspecified by the endpoint. This guarantee excludes resource metadata, such as\nobject names and bucket IAM policies. For more information,\nsee [Note on service data](/assured-workloads/docs/data-residency#service-data).\n\nSupported locations\n-------------------\n\nYou can use regional endpoints to keep your data within the following\n[locations](/storage/docs/locations):\n\n- All regions\n\n- `US` multi-region\n\n- `EU` multi-region\n\nSupported operations\n--------------------\n\nRegional endpoints can only be used to perform operations that access or mutate\nresources within the location specified by the endpoint. Regional endpoints\ncannot be used to perform operations that access or mutate resources outside of\nthe location specified by the endpoint.\n\nFor example, when you use the regional endpoint\n`https://storage.me-central2.rep.googleapis.com`, you can read objects in\nbuckets located in `ME-CENTRAL2`, and copy an object from a source bucket to a\ndestination bucket only when both buckets are located in `ME-CENTRAL2`. If you\nattempt to read or copy an object outside of `ME-CENTRAL2`, you get an\nerror.\n\nRegional endpoints can be used to perform supported bucket, object, and\ninventory report operations, as long as the operations are performed on\nresources stored in the location specified by the endpoint.\n\nFor a full list of operations that are supported in Cloud Storage,\nexpand the **Supported operations** section:\n\n#### Supported operations\n\n- Object operations\n - Creating objects\n - Composing objects\n - Copying objects^1^\n - Deleting objects\n - Getting object metadata^2^\n - Listing objects\n - Patching objects\n - Rewriting objects^1^\n - Updating objects\n- Bucket operations\n - Creating buckets\n - Deleting buckets\n - Getting bucket metadata^2^\n - Listing buckets\n - Locking bucket retention policies\n - Patching buckets\n - Updating buckets\n- Operations on IAM policies\n - Getting bucket IAM policies^2^\n - Updating bucket IAM policies^2^\n - Testing bucket IAM policies^2^\n- Operations on ACLs\n - Creating object ACLs^2^\n - Creating default object ACLs for a bucket^2^\n - Deleting object ACLs^2^\n - Deleting default object ACLs for a bucket^2^\n - Getting object ACLs^2^\n - Getting default object ACLs for a bucket^2^\n - Listing object ACLs^2^\n - Listing default object ACLs for a bucket^2^\n - Patching object ACLs^2^\n - Patching default object ACLs for a bucket^2^\n - Updating object ACLs^2^\n - Updating default object ACLs for a bucket^2^\n- Storage Insights operations\n - Creating inventory report configurations\n - Deleting inventory report configurations\n - Getting inventory reports\n - Getting inventory report configurations\n - Listing inventory reports\n - Listing inventory report configurations\n - Patching inventory report configurations\n\n^1^This operation only succeeds if the source and destination\nbuckets are in the location specified by the endpoint.\n\n^2^This operation accesses or mutates metadata. Compliance with\ndata residency and data sovereignty requirements are not guaranteed for this\noperation.\n\nLimitations and restrictions\n----------------------------\n\nRegional endpoints cannot be used to perform the following operations:\n\n- Copying or rewriting resources from one location to another\n\n- [HMAC key](/storage/docs/authentication/hmackeys) operations\n\n- [Service account](/storage/docs/projects#service-accounts) operations\n\n- [Pub/Sub notification](/storage/docs/pubsub-notifications) operations\n\n- [JSON batch](/storage/docs/batch) operations\n\nKeep in mind the following restrictions when using regional endpoints:\n\n- Regional endpoints don't support [mutual TLS (mTLS)](/storage/docs/request-endpoints#mtls).\n\n- Regional endpoints only support HTTPS. HTTP is not supported.\n\nTools for using regional endpoints\n----------------------------------\n\n### Console\n\nTo access Cloud Storage resources in a manner that's compliant with\ndata residency or sovereignty requirements, use the jurisdictional\nGoogle Cloud console URLs:\n\nReplace \u003cvar translate=\"no\"\u003eJURISDICTION\u003c/var\u003e with one of the following\nvalues:\n\n- `eu` if the resource is located in the European Union\n\n- `sa` if the resource is located in the Kingdom of Saudi Arabia\n\n- `us` if the resource is located in the United States\n\n| **Note:** You cannot use the jurisdictional Google Cloud console to upload or download objects.\n\n### Command line\n\nTo configure the Google Cloud CLI for use with regional endpoints,\ncomplete the following steps:\n\n1. Make sure you're using the Google Cloud CLI 402.0.0 or newer.\n\n2. Set the `api_endpoint_overrides/storage` property to the regional\n endpoint you want to use:\n\n ```\n gcloud config set api_endpoint_overrides/storage https://storage.LOCATION.rep.googleapis.com/\n ```\n\n Alternatively, you can set the\n `CLOUDSDK_API_ENDPOINT_OVERRIDES_STORAGE` environment variable to the\n endpoint: \n\n ```\n CLOUDSDK_API_ENDPOINT_OVERRIDES_STORAGE=https://storage.LOCATION.rep.googleapis.com/ gcloud ls gs://my-bucket\n ```\n\n### REST APIs\n\n### JSON API\n\nWhen making requests to regional endpoints, use the following URIs:\n\n- For general JSON API requests, excluding object uploads, use the\n following endpoint, replacing \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e with a supported\n [bucket location](#supported-locations):\n\n ```\n https://storage.LOCATION.rep.googleapis.com\n ```\n\n For example, the following endpoint is used to create a bucket in the\n `ME-CENTRAL2` region: \n\n ```\n https://storage.me-central2.rep.googleapis.com\n ```\n- For JSON API object uploads, use the following endpoint:\n\n ```\n https://storage.LOCATION.rep.googleapis.com/upload/storage/v1/b/BUCKET_NAME/o\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e with a supported [bucket location](#supported-locations).\n\n - \u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e with the name of the bucket to which you want\n to upload an object.\n\n For example, the following endpoint is used to upload an object to\n a bucket in the `ME-CENTRAL2` region: \n\n ```\n https://storage.me-central2.rep.googleapis.com/upload/storage/v1/b/my-example-bucket/o\n ```\n- For JSON API object downloads, use the following endpoint:\n\n ```\n https://storage.LOCATION.rep.googleapis.com/download/storage/v1/b/BUCKET_NAME/o/OBJECT_NAME?alt=media\n ```\n\n Replace:\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e with a supported [bucket location](#supported-locations).\n\n - \u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e with the name of the bucket that\n contains the object you want to download.\n\n - \u003cvar translate=\"no\"\u003eOBJECT_NAME\u003c/var\u003e with the name of the object you want\n to download.\n\n### XML API\n\nWhen making requests to regional endpoints, use the path-style or\nvirtual hosted-style endpoint:\n\n- Path-style endpoint:\n\n ```\n https://storage.LOCATION.rep.googleapis.com/BUCKET_NAME/OBJECT_NAME\n ```\n\n \u003cbr /\u003e\n\n- Virtual hosted-style endpoint:\n\n ```\n https://BUCKET_NAME.storage.LOCATION.rep.googleapis.com/OBJECT_NAME\n ```\n\n \u003cbr /\u003e\n\n Replace:\n - \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e with a supported [bucket location](#supported-locations).\n\n - \u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e with the name of a bucket.\n\n - \u003cvar translate=\"no\"\u003eOBJECT_NAME\u003c/var\u003e with the name of an object.\n\nFor example, the following sample can be used to upload an object to a\nbucket in the `ME-CENTRAL2` region: \n\n```\nhttps://storage.me-central2.rep.googleapis.com/my-example-bucket/my-example-object\n```\n\nRestricting global API endpoint usage\n-------------------------------------\n\nTo help enforce the use of regional endpoints, you can use the\n`constraints/gcp.restrictEndpointUsage` organization policy constraint to block\nrequests to the global API endpoint. For more information, see the\n[Restrict Endpoint Usage](/assured-workloads/docs/restrict-endpoint-usage) documentation."]]
