anchor.diff:    "private_key_id": "...",
     "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
     "client_email": "service-account-for-your-repository@your-project-id.iam.gserviceaccount.com",
  -  "client_id": "..."
  +  "client_id": "...",
  +  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  +  "token_uri": "https://accounts.google.com/o/oauth2/token",
  +  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  +  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/your-bucket@your-project-id.iam.gserviceaccount.com"
   }
   ----
   // NOTCONSOLE
   
  -This file must be stored in the {ref}/secure-settings.html[elasticsearch keystore], under a setting name
  -of the form `gcs.client.NAME.credentials_file`, where `NAME` is the name of the client configuration.
  -The default client name is `default`, but a different client name can be specified in repository
  -settings using `client`.
  -
  -For example, if specifying the credentials file in the keystore under
  -`gcs.client.my_alternate_client.credentials_file`, you can configure a repository to use these
  -credentials like this:
  +To provide this file to the plugin, it must be stored in the {ref}/secure-settings.html[Elasticsearch keystore].  You must add a setting name of the form `gcs.client.NAME.credentials_file`, where `NAME`
  +is the name of the client configuration for the repository. The implicit client
  +name is `default`, but a different client name can be specified in the
  +repository settings with the `client` key. 
  +
  +NOTE: Passing the file path via the GOOGLE_APPLICATION_CREDENTIALS environment 
  +variable is **not** supported.
  +
  +For example, if you added a `gcs.client.my_alternate_client.credentials_file` 
  +setting in the keystore, you can configure a repository to use those credentials 
  +like this:
   
   [source,js]
   ----
  
positive.code: 
  `project_id`::
  
      The Google Cloud project id. This will be automatically infered from the credentials file but
      can be specified explicitly. For example, it can be used to switch between projects when the
      same credentials are usable for both the production and the development projects.
  
  
negative.code: 
  The service account used to access the bucket must have the "Writer" access to the bucket:
  
  1. Connect to the https://console.cloud.google.com/[Google Cloud Platform Console].
  2. Select your project.
  3. Got to the https://console.cloud.google.com/storage/browser[Storage Browser].
  4. Select the bucket and "Edit bucket permission".
  5. The service account must be configured as a "User" with "Writer" access.
  