Update an SFTP server

You can update the users who are allowed to connect to a Cloud FTP server by updating the server's access configuration. You can also update metadata like the server's display name.

You can't change whether a server is external or internal after the server has been created.

Required roles

To get the permission that you need to update an SFTP server, ask your administrator to grant you the Cloud FTP Admin (roles/ftp.admin) IAM role on your project. For more information about granting roles, see Manage access to projects, folders, and organizations.

This predefined role contains the ftp.servers.update permission, which is required to update an SFTP server.

You might also be able to get this permission with custom roles or other predefined roles.

Update access for an external server

gcloud

To update the access configuration for an external server, run the gcloud alpha storage ftp servers update command. Provide the --allowed-cidr-blocks flag.

Caution: The CIDR blocks that you provide in the request overwrite all existing values.

Before using any of the command data below, make the following replacements:

• SERVER_ID: the server ID.
• LOCATION_ID: the location of the server, such as us-west1.
• CIDR_BLOCK: a CIDR block that is allowed to access the server. For example, 192.0.2.0/24. You must provide at least one value, and can provide a maximum of 500 CIDR blocks in a comma-separated list. To allow connections from all IP addresses, use 0.0.0.0/0.

Execute the following command:

Linux, macOS, or Cloud Shell

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha storage ftp servers update SERVER_ID --location=LOCATION_ID \
    --allowed-cidr-blocks=CIDR_BLOCK

Windows (PowerShell)

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha storage ftp servers update SERVER_ID --location=LOCATION_ID `
    --allowed-cidr-blocks=CIDR_BLOCK

Windows (cmd.exe)

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha storage ftp servers update SERVER_ID --location=LOCATION_ID ^
    --allowed-cidr-blocks=CIDR_BLOCK

It takes a few seconds for the server to be updated.

REST

To update the access configuration for an external server, use the servers.patch method. In the updateMask query parameter, provide the externalConfig field.

Caution: The CIDR blocks that you provide in the request overwrite all existing values.

Before using any of the request data, make the following replacements:

• PROJECT_ID: the Google Cloud project ID of the server.
• LOCATION_ID: the location of the server, such as us-west1.
• SERVER_ID: the server ID.
• CIDR_BLOCK: a CIDR block that is allowed to access the server. For example, 192.0.2.0/24. You must provide at least one value, and can provide a maximum of 500 CIDR blocks . To allow connections from all IP addresses, use 0.0.0.0/0.

HTTP method and URL:

PATCH https://ftp.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/servers/SERVER_ID?updateMask=externalConfig

Request JSON body:

{
  "externalConfig": {
    "allowedCidrBlocks": [
      "CIDR_BLOCK"
    ]
  }
}

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login , or by using Cloud Shell, which automatically logs you into the gcloud CLI . You can check the currently active account by running gcloud auth list.

Save the request body in a file named request.json, and execute the following command:

curl -X PATCH \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://ftp.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/servers/SERVER_ID?updateMask=externalConfig"

PowerShell (Windows)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login . You can check the currently active account by running gcloud auth list.

Save the request body in a file named request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method PATCH `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://ftp.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/servers/SERVER_ID?updateMask=externalConfig" | Select-Object -Expand Content

The response identifies a long-running operation. It takes a few seconds for the server to be updated.

Update access for an internal server

gcloud

To update the access configuration for an internal server, run the gcloud alpha storage ftp servers update command. Provide the --consumer-accept-list flag, and optionally provide the --consumer-reject-list flag.

Caution: The lists of allowed consumer projects and rejected consumer projects that you provide in the request overwrite all existing values.

Before using any of the command data below, make the following replacements:

• SERVER_ID: the server ID.
• LOCATION_ID: the location of the server, such as us-west1.

• PROJECT_TO_ALLOW: the project ID or number of a consumer project that is allowed to connect to the server by using Private Service Connect. For example, example-allowed-project. You must specify at least one project.

  You can allow a maximum of 500 projects. Provide multiple projects and their respective connection limits in a comma-separated list. For example, --consumer-accept-list=projectA=20,projectB=15.

• CONNECTION_LIMIT: the maximum number of Private Service Connect endpoints that can be created in the consumer project. The value must be from 1 to 250 endpoints.

• (Optional) PROJECT_TO_REJECT: the project ID or number of a consumer project that is prohibited from connecting to the server. For example, example-rejected-project. Projects in this list are rejected from accessing the server even if they are included in the list of allowed projects.

  You can reject a maximum of 64 projects. Provide multiple projects in a comma-separated list.

  If you don't want to explicitly reject any projects, then omit the --consumer-reject-list flag.

Execute the following command:

Linux, macOS, or Cloud Shell

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha storage ftp servers update SERVER_ID --location=LOCATION_ID \
    --consumer-accept-list=PROJECT_TO_ALLOW=CONNECTION_LIMIT \
    --consumer-reject-list=PROJECT_TO_REJECT

Windows (PowerShell)

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha storage ftp servers update SERVER_ID --location=LOCATION_ID `
    --consumer-accept-list=PROJECT_TO_ALLOW=CONNECTION_LIMIT `
    --consumer-reject-list=PROJECT_TO_REJECT

Windows (cmd.exe)

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha storage ftp servers update SERVER_ID --location=LOCATION_ID ^
    --consumer-accept-list=PROJECT_TO_ALLOW=CONNECTION_LIMIT ^
    --consumer-reject-list=PROJECT_TO_REJECT

It takes a few seconds for the server to be updated.

REST

To update the access configuration for an internal server, use the servers.patch method. In the updateMask query parameter, provide the internalConfig field.

Caution: The lists of allowed consumer projects and rejected consumer projects that you provide in the request overwrite all existing values.

Before using any of the request data, make the following replacements:

• PROJECT_ID: the Google Cloud project ID of the server.
• LOCATION_ID: the location of the server, such as us-west1.
• SERVER_ID: the server ID.

• PROJECT_TO_ALLOW: the project ID or number of a consumer project that is allowed to connect to the server by using Private Service Connect. For example, example-allowed-project. You must specify at least one project.

  You can allow a maximum of 500 projects.

• CONNECTION_LIMIT: the maximum number of Private Service Connect endpoints that can be created in the consumer project. The value must be from 1 to 250 endpoints.

• (Optional) PROJECT_TO_REJECT: the project ID or number of a consumer project that is prohibited from connecting to the server. For example, example-rejected-project. Projects in this list are rejected from accessing the server even if they are included in the list of allowed projects.

  You can reject a maximum of 64 projects.

  If you don't want to explicitly reject any projects, then omit the consumerRejectList object.

HTTP method and URL:

PATCH https://ftp.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/servers/SERVER_ID?updateMask=internalConfig

Request JSON body:

{
  "internalConfig": {
    "consumerAcceptList": [
      {
        "project": "projects/PROJECT_TO_ALLOW",
        "connectionLimit": CONNECTION_LIMIT
      }
    ],
    "consumerRejectList": [
      {
        "project": "projects/PROJECT_TO_REJECT"
      }
    ]
  }
}

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login , or by using Cloud Shell, which automatically logs you into the gcloud CLI . You can check the currently active account by running gcloud auth list.

Save the request body in a file named request.json, and execute the following command:

curl -X PATCH \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://ftp.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/servers/SERVER_ID?updateMask=internalConfig"

PowerShell (Windows)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login . You can check the currently active account by running gcloud auth list.

Save the request body in a file named request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method PATCH `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://ftp.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/servers/SERVER_ID?updateMask=internalConfig" | Select-Object -Expand Content

The response identifies a long-running operation. It takes a few seconds for the server to be updated.

Update a server's display name

gcloud

To update metadata such as the display name of an SFTP server, run the gcloud alpha storage ftp servers update command.

Before using any of the command data below, make the following replacements:

• SERVER_ID: the server ID.
• LOCATION_ID: the location of the server, such as us-west1.
• DISPLAY_NAME: a display name for the server.

Execute the following command:

Linux, macOS, or Cloud Shell

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha storage ftp servers update SERVER_ID --location=LOCATION_ID \
    --display-name="DISPLAY_NAME"

Windows (PowerShell)

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha storage ftp servers update SERVER_ID --location=LOCATION_ID `
    --display-name="DISPLAY_NAME"

Windows (cmd.exe)

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha storage ftp servers update SERVER_ID --location=LOCATION_ID ^
    --display-name="DISPLAY_NAME"

It takes a few seconds for the server to be updated.

REST

To update metadata such as the display name of an SFTP server, use the servers.patch method. In the updateMask query parameter, provide a comma-separated list of fields to update. In the request body, provide a JSON object with the values to set.

Before using any of the request data, make the following replacements:

• PROJECT_ID: the Google Cloud project ID of the server.
• LOCATION_ID: the location of the server, such as us-west1.
• SERVER_ID: the server ID.
• FIELDS_TO_UPDATE: a comma-separated list of fields to update, relative to the server resource. For example, to update the display name, provide the query parameter updateMask=displayName.
• DISPLAY_NAME: a display name for the server.

HTTP method and URL:

PATCH https://ftp.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/servers/SERVER_ID?updateMask=FIELDS_TO_UPDATE

Request JSON body:

{
  "displayName": "DISPLAY_NAME"
}

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login , or by using Cloud Shell, which automatically logs you into the gcloud CLI . You can check the currently active account by running gcloud auth list.

Save the request body in a file named request.json, and execute the following command:

curl -X PATCH \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://ftp.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/servers/SERVER_ID?updateMask=FIELDS_TO_UPDATE"

PowerShell (Windows)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login . You can check the currently active account by running gcloud auth list.

Save the request body in a file named request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method PATCH `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://ftp.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/servers/SERVER_ID?updateMask=FIELDS_TO_UPDATE" | Select-Object -Expand Content

The response identifies a long-running operation. It takes a few seconds for the server to be updated.