Documentation

Sovereign BYOC Deployment Guide

Provision your own sovereign Google Cloud Storage buckets and KMS encryption keys within your GCP project, granting MassiveTrust exact least-privilege access.

UPDATED: AUGUST 2026•REQUIRES: TERRAFORM >= 1.5.0

I. Deployment Sequence

1

Configure Environment & Credentials

Requires GCP Owner or Security Admin

Ensure the gcloud CLI and Terraform are installed on your workstation. Authenticate with your enterprise GCP project:

gcloud auth application-default login

Create a new directory for the MassiveTrust BYOC module and save the main.tf and terraform.tfvars files provided below.

2

Fill Out terraform.tfvars

Scope Boundary Validation

Edit your terraform.tfvars with your GCP Project ID, preferred bucket location (e.g., us-east4 or europe-west1), and the MassiveTrust Hub Project ID provided by your account manager. Ensure the region matches your data sovereignty SLA.

3

Deploy Sovereign Buckets & Custom IAM

Estimated runtime: 2-3 minutes

Initialize Terraform and review the execution plan before applying. This process creates a Custom IAM Role for the Master Vault that explicitly omits storage.objects.delete, making your vaulted assets immune to deletion from MassiveTrust.

# Initialize the working directory
terraform init
# Review the IAM bindings
terraform plan
# Execute the deployment
terraform apply
4

Connect to MassiveTrust Console

IAM Verification

Run the following command to print the exact configuration key-value pairs required by the MassiveTrust Console:

terraform output massivetrust_console_config

Navigate to Organization Governance > Storage Provisioning in your MassiveTrust dashboard. Click Connect Profile, paste these values into the form, and click Run IAM Probe & Connect.

II. Spoke Module Scripts

MassiveTrust BYOC Terraform

The complete, production-ready Terraform Spoke Module is open-source and available on GitHub. It includes the required custom IAM roles, bucket configurations, and KMS encryption layouts required to connect to our platform.