Two-way sync on Google Cloud Storage

Two-way sync reflects changes made directly in your bucket back into Salesforce. Read Two-way sync first for what it does and does not cover. This page is the Google Cloud side.

Two-way sync is a premium feature. It is switched on for your org by Sliick. Contact Sliick before you start.

Wire Pub/Sub to Sliick

Sliick provides the endpoint host to use in place of <sliick-host>.

gcloud pubsub topics create Sliick-gcs-events

gsutil notification create -t Sliick-gcs-events -f json \
  -e OBJECT_FINALIZE -e OBJECT_DELETE \
  -p "Salesforce-Files-<your org id>/" gs://YOUR_BUCKET

# A service account to act as the push identity, and permission for
# Google's Pub/Sub service agent to mint tokens as it
gcloud iam service-accounts create Sliick-push
gcloud iam service-accounts add-iam-policy-binding \
  Sliick-push@YOUR_PROJECT.iam.gserviceaccount.com \
  --member="serviceAccount:service-PROJECT_NUMBER@gcp-sa-pubsub.iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountTokenCreator"

gcloud pubsub subscriptions create Sliick-gcs-push \
  --topic=Sliick-gcs-events \
  --push-endpoint=https://<Sliick-host>/webhooks/gcs \
  --push-auth-service-account=Sliick-push@YOUR_PROJECT.iam.gserviceaccount.com \
  --push-auth-token-audience=https://<Sliick-host>/webhooks/gcs

The auth flags are required. Every delivery carries a Google-signed identity token, and Sliick verifies the sender is your service account before accepting the event. Leaving --push-auth-token-audience unset also works, because Pub/Sub then uses the full endpoint URL, which Sliick accepts.

Set the prefix filter. Use -p "Salesforce-Files-<your org id>/", or your custom storage root followed by /. Without it the bucket notifies on Sliick’s own staging uploads too. Those echoes are recognised and skipped, but the concurrent processing can race a user’s delete of the same file. External additions always land under the managed root, so nothing is lost by filtering.

Turn sync on in Salesforce

1. Open Sliick Files Setup → Sync.
2. Enter the full subscription name, for example projects/YOUR_PROJECT/subscriptions/sliick-gcs-push, and the push service account email.
3. Turn on Enable two-way sync and save.

An object added under a record’s folder then appears on that record.

External deletes do not sync here

The notification above subscribes to OBJECT_DELETE, which fires when an object is truly removed. With Object Versioning on, which is what makes Sliick’s own deletes restorable, deleting the live object instead archives it as a noncurrent generation, which fires a different event Sliick does not subscribe to.

So while Object Versioning is on, an object deleted directly in the bucket does not disappear from its Salesforce record, and is not parked in Deleted Files. The Salesforce side stays as it was until someone removes the file there too.

This is a Google Cloud event-delivery limitation, not a reason to turn Object Versioning off. Adds and edits sync normally regardless.

A console “rename” is really a copy plus a delete. The copy syncs in as a new file; the delete half does not sync, so the old entry stays on the record until you remove it in Salesforce.