gcloud compute scp: Copy Files To and From a VM

gcloud compute scp transfers files to or from a VM using the same key management as gcloud compute ssh.

Shipping a build artifact onto a VM, or pulling logs off it, is a single scp call. It reuses gcloud-managed SSH keys so there is nothing extra to configure.

What it does

gcloud compute scp copies local files to a remote VM (or the reverse) over SSH, prefixing the remote side with instance-name:. It manages keys exactly like gcloud compute ssh and supports IAP tunneling.

Common usage

Terminal

# upload a build artifact to the VM
gcloud compute scp ./app.tar.gz runner-1:/tmp/ \
  --zone=us-central1-a
# pull logs back, recursively, over IAP
gcloud compute scp --recurse runner-1:/var/log/app \
  ./logs --zone=us-central1-a --tunnel-through-iap

Flags

Flag	What it does
--zone <zone>	Zone of the target instance
--recurse	Copy directories recursively
--tunnel-through-iap	Transfer via Identity-Aware Proxy
--compress	Enable SSH compression for the transfer
--scp-flag <flag>	Pass an extra flag straight to scp

In CI

Use --tunnel-through-iap for private VMs and prefix the remote path with the instance name plus a colon. The runner identity needs the same roles/iap.tunnelResourceAccessor role that gcloud compute ssh requires.

Common errors in CI

"Permission denied (publickey)" mirrors the ssh case: keys not yet propagated or OS Login permissions missing. "scp: /path: Permission denied" means the remote user cannot write the target directory; copy into /tmp and sudo move it. "Cannot specify both a source and destination on the same machine" means neither side had the instance:path prefix.