gcloud compute images import - import an image into Compute Engine

gcloud compute images importIMAGE_NAME--cmd-deprecated(--source-file=SOURCE_FILE    |--source-image=SOURCE_IMAGE    |--aws-access-key-id=AWS_ACCESS_KEY_ID--aws-region=AWS_REGION--aws-secret-access-key=AWS_SECRET_ACCESS_KEY--aws-session-token=AWS_SESSION_TOKEN (--aws-source-ami-file-path=AWS_SOURCE_AMI_FILE_PATH |--aws-ami-export-location=AWS_AMI_EXPORT_LOCATION--aws-ami-id=AWS_AMI_ID))[--no-address][--async][--cloudbuild-service-account=CLOUDBUILD_SERVICE_ACCOUNT][--compute-service-account=COMPUTE_SERVICE_ACCOUNT][--description=DESCRIPTION][--family=FAMILY][--no-guest-environment][--guest-os-features=[GUEST_OS_FEATURE,…]][--log-location=LOG_LOCATION][--network=NETWORK][--storage-location=STORAGE_LOCATION][--subnet=SUBNET][--timeout=TIMEOUT; default="2h"][--zone=ZONE][--data-disk    |--byol--os=OS][GCLOUD_WIDE_FLAG …]

Importing images involves four steps:

• Upload the virtual disk file to Cloud Storage.
• Import the image to Compute Engine.
• Detect the OS and bootloader contained on the disk.
• Translate the image to make a bootable image. This command performs all four ofthese steps as required, depending on the input arguments specified.

Before importing an image, set up access to Cloud Storage and grant requiredroles to the user accounts and service accounts. For more information, seehttps://cloud.google.com/compute/docs/import/requirements-export-import-images.

To override the detected OS, specify the--os flag. You can omitthe translation step using the--data-disk flag.

If you exported your disk from Compute Engine then you don't need to re-importit. Instead, usegcloud compute imagescreate to create more images from the disk.

Files stored on Cloud Storage and images in Compute Engine incur charges. Seehttps://cloud.google.com/compute/docs/images/importing-virtual-disks#resource_cleanup.

Troubleshooting: Image import/export tools rely on CloudBuild default behavior.They has been using the default CloudBuild service account in order toimport/export images to/from Google Cloud Platform. However, Cloud Build haschanged this default behavior and in new projects a custom user managed serviceaccount may need to be provided to perform the builds. If you get a CloudBuildservice account related error, run gcloud with--cloudbuild-service-account=<custom service account>. Seegcloudcompute images import --help for details.

gcloudcomputeimagesimportmyimage-name--os=centos-7--source-file=mysourcefile

To import a data disk without operating system, run:

gcloudcomputeimagesimportmyimage-name--data-disk--source-file=mysourcefile

IMAGE_NAME

Name of the disk image to create.

--cmd-deprecated

The command you're using is deprecated and will be removed by December 31, 2025.We recommend usinggcloud computemigration image-imports instead. See our official documentation formore information.https://cloud.google.com/migrate/virtual-machines/docs/5.0/migrate/image_import.

Exactly one of these must be specified:

Image import from local file, Cloud Storage or Compute Engine image.

At most one of these can be specified:

--source-file=SOURCE_FILE

A local file, or the Cloud Storage URI of the virtual disk file to import. Forexample:gs://my-bucket/my-image.vmdk or./my-local-image.vmdk. For more informationabout Cloud Storage URIs, seehttps://cloud.google.com/storage/docs/request-endpoints#json-api.

--source-image=SOURCE_IMAGE

An existing Compute Engine image from which to import.

Image import from AWS.

--aws-access-key-id=AWS_ACCESS_KEY_ID

Access key ID for a temporary AWS credential. This ID must be generated usingthe AWS Security Token Service.

This flag argument must be specified if any of the other arguments in this groupare specified.

--aws-region=AWS_REGION

AWS region of the image that you want to import.

This flag argument must be specified if any of the other arguments in this groupare specified.

--aws-secret-access-key=AWS_SECRET_ACCESS_KEY

Secret access key for a temporary AWS credential. This key must be generatedusing the AWS Security Token Service.

This flag argument must be specified if any of the other arguments in this groupare specified.

--aws-session-token=AWS_SESSION_TOKEN

Session token for a temporary AWS credential. This session token must begenerated using the AWS Security Token Service.

This flag argument must be specified if any of the other arguments in this groupare specified.

Specify whether to import from an AMI or disk image.Exactly one of these must be specified:

If importing a disk image, specify the following:

--aws-source-ami-file-path=AWS_SOURCE_AMI_FILE_PATH

S3 resource path of the exported image file that you want to import.

If importing an AMI, specify the following two flags:

--aws-ami-export-location=AWS_AMI_EXPORT_LOCATION

An AWS S3 bucket location where the converted image file can be temporarilyexported to before the import to Cloud Storage.

This flag argument must be specified if any of the other arguments in this groupare specified.

--aws-ami-id=AWS_AMI_ID

AWS AMI ID of the image to import.

This flag argument must be specified if any of the other arguments in this groupare specified.

--no-address

Temporary VMs are created in your project during image import. Set this flag sothat these temporary VMs are not assigned external IP addresses.

Note: The image import process requires package managers to be installed on theoperating system for the virtual disk. These package managers might need to makerequests to package repositories that are outside Google Cloud. To allow accessfor these updates, you need to configure Cloud NAT and Private Google Access.For more information, seehttps://cloud.google.com/compute/docs/import/importing-virtual-disks#no-external-ip.

--async

Return immediately, without waiting for the operation in progress to complete.

--cloudbuild-service-account=CLOUDBUILD_SERVICE_ACCOUNT

Image import and export tools use Cloud Build to import and export images to andfrom your project. Cloud Build uses a specific service account to execute buildson your behalf. The Cloud Build service account generates an access token forother service accounts and it is also used for authentication when building theartifacts for the image import tool.

Use this flag to to specify a user-managed service account for image import andexport. If you don't specify this flag, Cloud Build runs using your project'sdefault Cloud Build service account. To set this option, specify the emailaddress of the desired user-managed service account. Note: You must specify the--logs-location flag when you set a user-managed service account.

At minimum, the specified user-managed service account needs to have thefollowing roles assigned:

• roles/compute.admin
• roles/iam.serviceAccountTokenCreator
• roles/iam.serviceAccountUser

--compute-service-account=COMPUTE_SERVICE_ACCOUNT

A temporary virtual machine instance is created in your project during imageimport. Image import tooling on this temporary instance must be authenticated.

A Compute Engine service account is an identity attached to an instance. Itsaccess tokens can be accessed through the instance metadata server and can beused to authenticate image import tooling on the instance.

To set this option, specify the email address corresponding to the requiredCompute Engine service account. If not provided, the image import on thetemporary instance uses the project's default Compute Engine service account.

At a minimum, you need to grant the following roles to the specified Cloud Buildservice account:

• roles/compute.storageAdmin
• roles/storage.objectViewer

--description=DESCRIPTION

Description to set for the imported image.

--family=FAMILY

Family to set for the imported image.

--guest-environment

Installs the guest environment on the image. Seehttps://cloud.google.com/compute/docs/images/guest-environment.Enabled by default, use--no-guest-environment to disable.

--guest-os-features=[GUEST_OS_FEATURE,…]

Enables one or more features for VM instances that use the image for their bootdisks. See the descriptions of supported features at:https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#guest-os-features.GUEST_OS_FEATURE must be (only one value is supported):UEFI_COMPATIBLE.

--log-location=LOG_LOCATION

Directory in Cloud Storage to hold build logs. If not set,gs://<project num>.cloudbuild-logs.googleusercontent.com/ iscreated and used.

--network=NETWORK

Name of the network in your project to use for the image import. When you importan image, the import tool creates and uses temporary VMs in your project for theimport process. Use this flag to specify the network to use for these temporaryVMs.

--storage-location=STORAGE_LOCATION

Specifies a Cloud Storage location, either regional or multi-regional, whereimage content is to be stored. If not specified, the multi-region locationclosest to the source is chosen automatically.

--subnet=SUBNET

Name of the subnetwork in your project to use for the image import. When youimport an image, the import tool creates and uses temporary VMs in your projectfor the import process. Use this flag to specify the subnetwork to use for thesetemporary VMs.

• If the network resource is in legacy mode, do not provide this property.
• If the network is in auto subnet mode, specifying the subnetwork is optional.
• If the network is in custom subnet mode, then this field must be specified.

--timeout=TIMEOUT; default="2h"

Maximum time an import can last before it fails as "TIMEOUT". For example, ifyou specify2h, the process fails after 2 hours. See $gcloud topic datetimes forinformation about duration formats.

This timeout option has a maximum value of 24 hours.

If you are importing a large image that takes longer than 24 hours to import,either use the RAW disk format to reduce the time needed for converting theimage, or split the data into several smaller images.

--zone=ZONE

Zone to use when importing the image. When you import an image, the import toolcreates and uses temporary VMs in your project for the import process. Use thisflag to specify the zone to use for these temporary VMs. Overrides the defaultcompute/zone property value for this command invocation.

At most one of these can be specified:

--data-disk

Specifies that the disk has no bootable OS installed on it. Imports the diskwithout making it bootable or installing Google tools on it.

--byol

Specifies that you want to import an image with an existing license. Importingan image with an existing license is known as bring your own license (BYOL).

--byol can be specified in any of the following ways:

+`--byol--os=rhel-8`:importsaRHEL8imagewithanexistinglicense.+`--os=rhel-8-byol`:importsaRHEL8imagewithanexistinglicense.+`--byol`:detectstheOScontainedonthedisk,andimportstheimagewithanexistinglicense.

For more information about BYOL, see:https://cloud.google.com/compute/docs/nodes/bringing-your-own-licenses

--os=OS

Specifies the OS of the disk image being imported.OSmust be one of:centos-7,centos-stream-8,centos-stream-9,debian-10,debian-11,debian-8,debian-9,opensuse-15,rhel-6,rhel-6-byol,rhel-7,rhel-7-byol,rhel-8,rhel-8-byol,rhel-9,rhel-9-byol,rocky-8,rocky-9,sles-12,sles-12-byol,sles-15,sles-15-byol,sles-sap-12,sles-sap-12-byol,sles-sap-15,sles-sap-15-byol,ubuntu-1404,ubuntu-1604,ubuntu-1804,ubuntu-2004,ubuntu-2204,windows-10-x64-byol,windows-10-x86-byol,windows-11-x64-byol,windows-2008r2,windows-2008r2-byol,windows-2012,windows-2012-byol,windows-2012r2,windows-2012r2-byol,windows-2016,windows-2016-byol,windows-2019,windows-2019-byol,windows-2022,windows-2022-byol,windows-7-x64-byol,windows-7-x86-byol,windows-8-x64-byol,windows-8-x86-byol.

Run$gcloud help for details.