.TH "GCLOUD_ALPHA_COMPUTE_SCP" 1



.SH "NAME"
.HP
gcloud alpha compute scp \- copy files to and from Google Compute Engine virtual machines via scp



.SH "SYNOPSIS"
.HP
\f5gcloud alpha compute scp\fR [[\fIUSER\fR@]\fIINSTANCE\fR:]\fISRC\fR [[[\fIUSER\fR@]\fIINSTANCE\fR:]\fISRC\fR\ ...] [[\fIUSER\fR@]\fIINSTANCE\fR:]\fIDEST\fR [\fB\-\-compress\fR] [\fB\-\-dry\-run\fR] [\fB\-\-force\-key\-file\-overwrite\fR] [\fB\-\-plain\fR] [\fB\-\-port\fR=\fIPORT\fR] [\fB\-\-recurse\fR] [\fB\-\-scp\-flag\fR=\fISCP_FLAG\fR] [\fB\-\-ssh\-key\-file\fR=\fISSH_KEY_FILE\fR] [\fB\-\-strict\-host\-key\-checking\fR=\fISTRICT_HOST_KEY_CHECKING\fR] [\fB\-\-zone\fR=\fIZONE\fR] [\fB\-\-internal\-ip\fR\ |\ \fB\-\-tunnel\-through\-iap\fR] [\fB\-\-network\fR=\fINETWORK\fR\ \fB\-\-region\fR=\fIREGION\fR\ :\ \fB\-\-dest\-group\fR=\fIDEST_GROUP\fR] [\fB\-\-ssh\-key\-expiration\fR=\fISSH_KEY_EXPIRATION\fR\ |\ \fB\-\-ssh\-key\-expire\-after\fR=\fISSH_KEY_EXPIRE_AFTER\fR] [\fIGCLOUD_WIDE_FLAG\ ...\fR]



.SH "DESCRIPTION"

\fB(ALPHA)\fR \fBgcloud alpha compute scp\fR securely copies files between a
virtual machine instance and your local machine using the scp command.

This command works for Linux VMs and Windows Server 2019 and later VMs that have
SSH enabled (https://cloud.google.com/compute/docs/connect/windows\-ssh).

In order to set up a successful transfer, follow these guidelines:
.RS 2m
.IP "\(bu" 2m
Prefix remote file names with the virtual machine instance name (e.g.,
\fIexample\-instance\fR:~/\fIFILE\fR).
.IP "\(bu" 2m
Local file names can be used as is (e.g., ~/\fIFILE\fR).
.IP "\(bu" 2m
File names containing a colon (``:'') must be invoked by either their absolute
path or a path that begins with ``./''.
.IP "\(bu" 2m
When the destination of your transfer is local, all source files must be from
the same virtual machine.
.IP "\(bu" 2m
When the destination of your transfer is remote instead, all sources must be
local.
.IP "\(bu" 2m
When the destination is Windows Server, the source must be using a similar SSH
version.
.RE
.sp

Under the covers, \fBscp(1)\fR is used to facilitate the transfer.

If the \f5\-\-region\fR and \f5\-\-network\fR flags are provided, then
\f5\-\-plain\fR and \f5\-\-tunnel\-through\-iap\fR are implied and any remote
file names must be prefixed with the remote IP address instead of the instance
name. This is most useful for connecting to on\-prem resources.



.SH "EXAMPLES"

To copy a remote directory, \f5~/narnia\fR, from \f5\fIexample\-instance\fR\fR
to the \f5~/wardrobe\fR directory of your local host, run:

.RS 2m
$ gcloud alpha compute scp \-\-recurse example\-instance:~/narnia \e
    ~/wardrobe
.RE

Conversely, files from your local computer can be copied to a virtual machine:

.RS 2m
$ gcloud alpha compute scp ~/localtest.txt ~/localtest2.txt \e
    example\-instance:~/narnia
.RE

Remote Windows\-based virtual machines require you to provide a path using
backslash notation:

.RS 2m
$ gcloud alpha compute scp ~/localtest.txt ~/localtest2.txt \e
    example\-windows\-instance:"C:\eUsers\ePublic"
.RE

Paths for remote Windows\-based virtual machines which contain spaces in
directory name should be appropriately protected with a pair of nested single
and double quotes:

.RS 2m
$ gcloud alpha compute scp ~/localtest.txt \e
    'example\-windows\-instance:"C:\eUsers\ePublic\eTest Folder"'
.RE

If the zone cannot be determined, you will be prompted for it. Use the
\f5\-\-zone\fR flag to avoid being prompted:

.RS 2m
$ gcloud alpha compute scp \-\-recurse example\-instance:~/narnia \e
    ~/wardrobe \-\-zone=us\-central1\-a
.RE

To specify the project, zone, and recurse all together, run:

.RS 2m
$ gcloud alpha compute scp \-\-project="my\-gcp\-project" \e
    \-\-zone="us\-east1\-b" \-\-recurse ~/foo\-folder/ gcp\-instance\-name:~/
.RE

You can limit the allowed time to ssh. For example, to allow a key to be used
through 2019:

.RS 2m
$ gcloud alpha compute scp \-\-recurse example\-instance:~/narnia \e
    ~/wardrobe \-\-ssh\-key\-expiration="2020\-01\-01T00:00:00:00Z"
.RE

Or alternatively, allow access for the next two minutes:

.RS 2m
$ gcloud alpha compute scp \-\-recurse example\-instance:~/narnia \e
    ~/wardrobe \-\-ssh\-key\-expire\-after=2m
.RE

To use the IP address of your remote VM (eg, for on\-prem), you must also
specify the \f5\-\-region\fR and \f5\-\-network\fR flags:

.RS 2m
$ gcloud alpha compute scp 10.1.2.3:~/narnia ~/wardrobe \e
    \-\-region=us\-central1 \-\-network=default
.RE



.SH "POSITIONAL ARGUMENTS"

.RS 2m
.TP 2m
[[\fIUSER\fR@]\fIINSTANCE\fR:]\fISRC\fR [[[\fIUSER\fR@]\fIINSTANCE\fR:]\fISRC\fR ...]

Specifies the files to copy.

.TP 2m
[[\fIUSER\fR@]\fIINSTANCE\fR:]\fIDEST\fR

Specifies a destination for the source files.


.RE
.sp

.SH "FLAGS"

.RS 2m
.TP 2m
\fB\-\-compress\fR

Enable compression.

.TP 2m
\fB\-\-dry\-run\fR

Print the equivalent scp/ssh command that would be run to stdout, instead of
executing it.

.TP 2m
\fB\-\-force\-key\-file\-overwrite\fR

If enabled, the gcloud command\-line tool will regenerate and overwrite the
files associated with a broken SSH key without asking for confirmation in both
interactive and non\-interactive environments.

If disabled, the files associated with a broken SSH key will not be regenerated
and will fail in both interactive and non\-interactive environments.

.TP 2m
\fB\-\-plain\fR

Suppress the automatic addition of \fBssh(1)\fR/\fBscp(1)\fR flags. This flag is
useful if you want to take care of authentication yourself or use specific
ssh/scp features.

.TP 2m
\fB\-\-port\fR=\fIPORT\fR

The port to connect to.

.TP 2m
\fB\-\-recurse\fR

Upload directories recursively.

.TP 2m
\fB\-\-scp\-flag\fR=\fISCP_FLAG\fR

Extra flag to be sent to scp. This flag may be repeated.

.TP 2m
\fB\-\-ssh\-key\-file\fR=\fISSH_KEY_FILE\fR

The path to the SSH key file. By default, this is
\f5\fI~/.ssh/google_compute_engine\fR\fR.

.TP 2m
\fB\-\-strict\-host\-key\-checking\fR=\fISTRICT_HOST_KEY_CHECKING\fR

Override the default behavior of StrictHostKeyChecking for the connection. By
default, StrictHostKeyChecking is set to 'no' the first time you connect to an
instance, and will be set to 'yes' for all subsequent connections.
\fISTRICT_HOST_KEY_CHECKING\fR must be one of: \fByes\fR, \fBno\fR, \fBask\fR.

.TP 2m
\fB\-\-zone\fR=\fIZONE\fR

The zone of the instance to copy files to/from.

If not specified and the \f5\fIcompute/zone\fR\fR property isn't set, you might
be prompted to select a zone (interactive mode only).

To avoid prompting when this flag is omitted, you can set the
\f5\fIcompute/zone\fR\fR property:

.RS 2m
$ gcloud config set compute/zone ZONE
.RE

A list of zones can be fetched by running:

.RS 2m
$ gcloud compute zones list
.RE

To unset the property, run:

.RS 2m
$ gcloud config unset compute/zone
.RE

Alternatively, the zone can be stored in the environment variable
\f5\fICLOUDSDK_COMPUTE_ZONE\fR\fR.

.TP 2m

At most one of these can be specified:


.RS 2m
.TP 2m
\fB\-\-internal\-ip\fR

Connect to instances using their internal IP addresses rather than their
external IP addresses. Use this to connect from one instance to another on the
same VPC network, over a VPN connection, or between two peered VPC networks.

For this connection to work, you must configure your networks and firewall to
allow SSH connections to the internal IP address of the instance to which you
want to connect.

To learn how to use this flag, see
https://cloud.google.com/compute/docs/instances/connecting\-advanced#sshbetweeninstances.

.TP 2m
\fB\-\-tunnel\-through\-iap\fR

Tunnel the ssh connection through Cloud Identity\-Aware Proxy for TCP
forwarding.

To learn more, see the IAP for TCP forwarding documentation
(https://cloud.google.com/iap/docs/tcp\-forwarding\-overview).

.RE
.sp
.TP 2m
\fB\-\-network\fR=\fINETWORK\fR

Configures the VPC network to use when connecting via IP address or FQDN.

.TP 2m
\fB\-\-region\fR=\fIREGION\fR

Configures the region to use when connecting via IP address or FQDN.

.TP 2m
\fB\-\-dest\-group\fR=\fIDEST_GROUP\fR

Configures the destination group to use when connecting via IP address or FQDN.

.TP 2m

At most one of these can be specified:


.RS 2m
.TP 2m
\fB\-\-ssh\-key\-expiration\fR=\fISSH_KEY_EXPIRATION\fR

The time when the ssh key will be valid until, such as
"2017\-08\-29T18:52:51.142Z." This is only valid if the instance is not using OS
Login. See $ gcloud topic datetimes for information on time formats.

.TP 2m
\fB\-\-ssh\-key\-expire\-after\fR=\fISSH_KEY_EXPIRE_AFTER\fR

The maximum length of time an SSH key is valid for once created and installed,
e.g. 2m for 2 minutes. See $ gcloud topic datetimes for information on duration
formats.


.RE
.RE
.sp

.SH "GCLOUD WIDE FLAGS"

These flags are available to all commands: \-\-access\-token\-file, \-\-account,
\-\-billing\-project, \-\-configuration, \-\-flags\-file, \-\-flatten,
\-\-format, \-\-help, \-\-impersonate\-service\-account, \-\-log\-http,
\-\-project, \-\-quiet, \-\-trace\-token, \-\-user\-output\-enabled,
\-\-verbosity.

Run \fB$ gcloud help\fR for details.



.SH "NOTES"

This command is currently in alpha and might change without notice. If this
command fails with API permission errors despite specifying the correct project,
you might be trying to access an API with an invitation\-only early access
allowlist. These variants are also available:

.RS 2m
$ gcloud compute scp
.RE

.RS 2m
$ gcloud beta compute scp
.RE