# How to set up an SFTP Server on Google Cloud (for Google Analytics data import)

> How to set up an SFTP server on Google Cloud platform – with the necessary steps for public key authentication required by the Google Analytics Data Import.

Source: https://www.measurelab.co.uk/insights/blog/sftp-gcp-google-analytics-data-import/  
Author: Mark Rochefort  
Published: 2023-12-01  
Updated: 2025-07-31

If you want to automate data import into Google Analytics 4 then (at the time of writing) you will need to have that data available on an Secure File Transfer Protocol (SFTP) server as a CSV file. We wanted a simple Google Cloud based solution for the sole purpose of making that data available for the regular (i.e. daily, weekly, monthly) uploading of data into Google Analytics 4, where it can be joined alongside existing data to enrich and inform further insights, activations and all that malarky.

This tutorial therefore mostly focuses on setting up an SFTP server on Google Cloud Platform - but also incorporates the necessary aspects for public key authentication required by the [Google Analytics Data Import](https://support.google.com/analytics/answer/10071301).

1. [Create new VM in Compute Engine](#vm-compute-engine)
2. [Setup your SFTP server](#sftp-server)
3. [Set up the data source in Google Analytics](#data-source-ga4)

#### **1) Create new VM in Compute Engine**

There's plenty of tutorials for this bit, so I'll be quick.

Choose a local region and size / type of machine (I went for the closest and smallest):

![](https://lh7-us.googleusercontent.com/znN7hwo-LhwAlOu5gAaslwpQJIh6En_a-bPH-vyOCNpWAHUzy25Y8xvc21bFvvcxEoyLlO2WJwCOoj2E18BWNy2wBubqzCwXygjstayDi91AixA8XWlgrOMSmWhXl4oxouhSDy9L7NzixxZJwO_A66k)

![](https://lh7-us.googleusercontent.com/m6HeOUYd0w6nqy0mocko3Ma03eQUBgN6IzqrWXrrXW1yNHJxgsPXw3ilcfEHfa3n2IvaAxnwBT6Cg5yP7-L3AcFh9DizQdkW9wpdZWyJj7bRjxsXPxe0eGnJhMzUC_Rgg_yBRx-EYIIZFPndD7mp2mM)

For this tutorial, I selected CentOS as the boot disk then left everything else as default.

You will get an external but ephemeral IP address. If you want it to be static (it changes every restart) then head to VPC Network, reserve a fixed IP address - binding it to this new instance like so:

![](https://lh7-us.googleusercontent.com/3ZcjPH6FIu5PbYGX3RJg4Fd8edv3dAiJWz5vWO8upeeABqo3IfANRyrLiZAGtjSkf-h76Y_Z_j0NGB7FmUhOTfzkk2NkO9PPd8zanwopZFiHWbEf8WVje-khQx4l3YMjnJOuhZyFkxx1TkiwtGPF8xo)

And also make sure your firewall rules allow port 22:

![](https://lh7-us.googleusercontent.com/7T3eFNakdBnAPxfwRQy6Tx0d0A6l5bZgmzNU6V1KzoCTmfKHaRmzvGWmUjYE7f5ElKBBJRnMqVTSXotwUU-BBa8EZqw1iODWT6sOlqd1PZNN4tor6-WON_saJFOOxSkorNfannEVbZIB6iKIUfQApDo)

#### **2) Setup your SFTP server**

Here you will need to create the user(s) you are going to use and configure the SSH daemon (ie the service that is running on the VM that listens and responds to requests - typically on port 22).

##### **SSH into VM using the SSH-in-browser**

Within Google console, you will be able to click the “SSH” button next to where the instance is listed, to SSH into the VM using the *SSH-in-browser*. This logs you in using SSH keys, passed to the browser.

![](https://storage.ghost.io/c/2b/29/2b2922bc-51da-44ac-8a48-6f70d3ab322e/content/images/2025/07/image-2-1.png)

##### **Create the user you will use for the SFTP** transfers

Once logged in to your instance, via SSH, follow these steps:

First add a user (replace <username> with the user you need to create - I called it *sftpuser*):

```
sudo adduser <username>
```

Now, assign a password to this user:

```
sudo passwd <username>
```

Then, create a group restricted for this user:

```
sudo groupadd restricted
```

And add user to the group:

```
sudo usermod -g restricted <username>
```

**Configure SSH to be able to login with this user**

Let’s go back to the SSH-in-Browser to step into the configuration of the SSH daemon, using the vi editor (see [https://www.cs.colostate.edu/helpdocs/vi.html](https://www.cs.colostate.edu/helpdocs/vi.html) - it really is a dark art all to itself but comes bundled with Linux distros and is worth knowing the basics of for quick config file editing like this!)

```
sudo vi /etc/ssh/sshd_config
```

for now just uncomment this line

*PasswordAuthentication yes*

Then restart the ssh daemon with

```
sudo service sshd restart
```

Check that you can use the new user credentials by logging in with an SFTP client tool like Filezilla:

- Address is the IP of the instance
- User and password will be what you set above

If all is working as expected, you should be able to login!

##### **Upload your CSV to the SFTP server**

Using the credentials in the SFTP client tool of your choice, upload your CSV (formatted following the template from Google Analytics), like so:

![](https://storage.ghost.io/c/2b/29/2b2922bc-51da-44ac-8a48-6f70d3ab322e/content/images/2025/07/image-1-1.png)

##### **Save SSH public keys on server**

Go grab the public key from Google (this is provided after you set up the transfer in step 3 ) and save it locally in a new file called *authorized_keys*.

The simplest way to transfer it will be to use the SFTP tool - so upload the *authorized_keys*file - like so:

![](https://storage.ghost.io/c/2b/29/2b2922bc-51da-44ac-8a48-6f70d3ab322e/content/images/2025/07/image-5.png)

Move the *authorized_keys* file to a newly created .ssh folder and ensure permissions on both the folder and file are both restricted such that just the user can read, write and execute:

![](https://storage.ghost.io/c/2b/29/2b2922bc-51da-44ac-8a48-6f70d3ab322e/content/images/2025/07/image-3.png)

![](https://storage.ghost.io/c/2b/29/2b2922bc-51da-44ac-8a48-6f70d3ab322e/content/images/2025/07/image-4.png)

##### **Configure the SSH service**

Now in the SSH-in-Browser again to configure the SSH daemon:

```
sudo vi /etc/ssh/sshd_config
```

Scroll right down to the end of the file, now hit the *i* key to edit and add this (which will ensure any users in the restricted group are only used for SFTP):

```
Match group restricted
ForceCommand internal-sftp
```

Once added at the end, hit the *esc*key followed by *:wq!* to write and quit the file.

Then restart the ssh daemon with

```
sudo service sshd restart
```

And, finally, you can watch the logs by running

```
sudo tail -f /var/log/messages
```

If you want more detail in these logs, edit the *sshd_config* file again by looking for the Logging configs and edit accordingly:

![](https://storage.ghost.io/c/2b/29/2b2922bc-51da-44ac-8a48-6f70d3ab322e/content/images/2025/07/image-6.png)

This gives you more detail on connections that are being attempted and so on, which is useful if you need to debug. Remember to restart the daemon and then watch the the logs again with:

```
sudo service sshd restart
sudo tail -f /var/log/messages
```

(Note there’s a bunch of other configurations you could be adding here to pin things down further - see reading at the end of this tutorial.)

#### **3) Set up the data source in Google Analytics**

Using the credentials you created earlier, set up and map your data source in Google Analytics (note - the SFTP server URL follows the format *sftp:///*)

![](https://storage.ghost.io/c/2b/29/2b2922bc-51da-44ac-8a48-6f70d3ab322e/content/images/2025/07/image-9.png)

I won’t go into the mapping of the data itself - the purpose of this tutorial is to just get a simple SFTP server running on GCP and to have it using the public keys from Google Analytics for authentication.

##### **Test the import**

Click *Import now*and see what happens! If you are still tailing the logs from above, you will see the connection being made by Google.

#### **Further reading**

[How to Setup a SFTP Server in Google Cloud Platform and Restrict Access | by Rubens Zimbres | Medium](https://medium.com/@rubenszimbres/how-to-setup-a-sftp-server-in-google-cloud-platform-and-restrict-access-32a09b430c7d)

[Setting Up SFTP Public Key Authentication On The Command Line | JSCAPE](https://www.jscape.com/blog/setting-up-sftp-public-key-authentication-command-line)

[[GA4] About Data Import - Analytics Help](https://support.google.com/analytics/answer/10071301)