---
title: "Cross Project Integration"
slug: "cross-project-integration"
updated: 2026-10-15T17:40:04Z
published: 2026-10-15T17:40:04Z
canonical: "docs.dataloop.ai/cross-project-integration"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dataloop.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cross Project Integration

## Overview

DDOE allows users with a GCP project to integrate their GCS bucket with the DDOE platform and create datasets. The GCP Cross Project integration stands as the best choice for GCP due to its significant advantages.

Important

- We recommend selecting **Cross-Project** as the integration type. It is GCP’s most secure option and provides enhanced protection for your data.
- Organizations can create up to 3 Cross Projects integrations. To increase the number of Cross Projects integrations for your organization, please contact our Customer support team.
- Only users with the Organization **Admin** or **Owner** roles are authorized to create integrations. [Learn more](https://docs.dataloop.ai/docs/org-members-groups#org-role-permissions)

The GCP cross-project integration process involves:

---

## 1. Create a Cloud Storage Bucket

1. Log in to [Google Cloud Console](https://console.cloud.google.com/getting-started).
2. From the left portal menu, go to Cloud Storage > **Buckets**.
3. Click **Create bucket**.
4. Enter a **Name** for the storage bucket, and click **Continue**.
5. In the **Choose where to store your data**, select a location for the bucket, and click **Continue**.
6. Click **Create bucket**.

**Note**: For all other optional settings, use the default values.

---

## 2. Create an IAM Role

1. Log in to the [Google Cloud Console](https://console.cloud.google.com/getting-started).
2. From the left portal menu, select the IAM & admin > **Roles**.
3. Click **+Create Role**.
4. Enter a role **Title**.
5. (Optional) Enter a **Description**.
6. (Optional) Enter a role **ID**. By default, the role ID is generated.
7. Click **+Add Permissions**, then search for and add the following permissions:
  1. `storage.objects.create`
  2. `storage.objects.delete`
  3. `storage.objects.get`
  4. `storage.objects.list`
  5. `storage.buckets.get`
  6. `storage.buckets.getIamPolicy`

**Note**:

- The `storage.objects.delete` permission allows the DDOE platform to delete dataset items. For more information, see the [Downstream](https://docs.dataloop.ai/docs/sync-cloud-storage-drivers#downstream) section.
- The `storage.buckets.getIamPolicy` permission allows the DDOE platform to validate that the integration was created successfully.

1. Click **Create**.

**Tip**

- See [Create and manage custom roles](https://cloud.google.com/iam/docs/creating-custom-roles) for more information on creating an IAM role in GCP.
- To display roles information, you must select a project in the Google Cloud Console. If not available, create a project.

---

## 3. Create the GCP Cross Project Integration

Maximum GCP Cross Project Integrations

You can create only maximum of 3 GCP Cross Project Integrations.

Who can create?

Only users with the Organization **Admin** or **Owner** roles are authorized to create integrations. [Learn more](https://docs.dataloop.ai/docs/org-members-groups#org-role-permissions)

1. Log in to the DDOE platform.
2. From the left-side panel, select **Integrations**.
3. Click **Create Integration** -> **Create Storage Integration**. A pop-up window is displayed on the right-side.
4. **Integration Name**: Enter a **Name** for the integration.
5. **Provider**: Choose **GCP** from the list.
6. **Integration Type**: Select the **Cross Project** from the list.
7. Click **Get New Service Account**. Copy and add the Service Account ID as a principal in your project, and assign it with the relevant role. [Assign a role](https://cloud.google.com/iam/docs/overview#roles).
8. Or, click **Existing Service Account** in case you already created one, you can choose from the list of created Service Accounts that have not been assigned to an integration.
9. **Service Account ID**: Copy the **Service Accounts ID** (Email).
10. **Resource Name**: Follow this [steps](/docs/cross-project-integration#grant-dataloop-service-account-permissions) and enter the resource name.
11. Click **Create Integration**.

---

## 4. Grant Permissions to the DDOE Service Account

To grant DDOE service account permissions to access the Cloud Storage Bucket:

1. Log in to [Google Cloud Console](https://console.cloud.google.com/getting-started).
2. From the left portal menu, go to Cloud Storage > **Buckets**.
3. Select the **Storage** bucket for which you want to add permissions, and then click on it.
4. Select the **Permissions** tab.
5. Click **Grant access**. The Add Principals dialog box appears.
6. Under the **Add principals**, add the Service account ID provided by the DDOE platform.
7. Under the **Assign roles**, choose **custom** and choose the role you recently created.
8. Click **Save**. A confirmation message is displayed.

**Tip**: See [Use IAM with buckets](https://cloud.google.com/storage/docs/access-control/using-iam-permissions#bucket-iam) for more information on adding permissions to a storage bucket in GCP.

---

## 5. Complete the GCP Cross Project Integration

1. Log in to the DDOE platform.
2. Under the **Resource name**, provide the name of the bucket you wish to integrate its data with the DDOE.
3. Click **Create Integration**. A confirmation message is displayed.

Troubleshooting Permission Errors

If you receive a permission denied error, even though the user's email is listed in the bucket’s IAM roles, it could be due to a stale or improperly propagated IAM configuration.

Recommended Fix:

- Remove the user’s email from the bucket’s IAM permission list.
- Re-add the same email with the appropriate role (e.g., Storage Object Viewer, Editor).

This action refreshes the IAM policy propagation, ensuring that the access rights take effect properly.