How to block public access to Cloud Storage buckets

Roles

• Storage Admin (roles/storage.admin) on the bucket to change bucket settings and IAM.
• Organization Policy Administrator (roles/orgpolicy.policyAdmin) on the organization to set the organization policy. Project IAM Admins do not have it by default.

Tools

• The Google Cloud console, or the gcloud CLI signed in with gcloud auth login.
• A list of buckets that must stay public on purpose, for example a static website. Public access prevention breaks those.

What the two settings do

• Public access prevention stops anyone from making bucket data public through IAM or ACLs. A bucket is either enforced or inherited. When inherited, it follows the storage.publicAccessPrevention organization policy constraint, checked at project, then folder, then organization.
• Uniform bucket-level access turns off ACLs so only IAM controls access. Anyone who had access only through object ACLs loses it.

Existing grants to allUsers and allAuthenticatedUsers are not deleted by public access prevention. They are overridden, and they take effect again if you later turn it off. Enforcement can take up to 10 minutes.

1. Find buckets that are open or may be open

Run the read-only commands in the next section. In the console go to Cloud Storage > Buckets and open each bucket's permissions and look for allUsers and allAuthenticatedUsers.

2. Check who relies on the public access

Google recommends reviewing usage logs, IAM policies, Cloud Asset Inventory and object ACLs before enforcing. Public object reads are not recorded in Cloud Audit Logs, so ask the application owners as well. Signed URLs and private access through a load balancer or Cloud CDN are not affected.

3. Check ACL usage before uniform bucket-level access

In Cloud Monitoring look at the metric storage.googleapis.com/authz/acl_operations_count. If requests show OBJECT_ACCESS_REQUIRED_OBJECT_ACL above zero, grant the equivalent IAM roles first. The legacy mapping is READER to roles/storage.legacyObjectReader and OWNER to roles/storage.legacyObjectOwner.

4. Turn the settings on, bucket by bucket (changes the project)

The commands below change your Google Cloud environment. Start with one non-critical bucket.

gcloud storage buckets update gs://BUCKET_NAME --public-access-prevention
gcloud storage buckets update gs://BUCKET_NAME --uniform-bucket-level-access

To remove an unwanted public grant at the source, run (changes the project):

gcloud storage buckets remove-iam-policy-binding gs://BUCKET_NAME --member=allUsers --role=IAM_ROLE

5. Enforce it across the organization (changes the organization)

Once the exceptions are known, set the constraint on the organization, or on a folder or project to start smaller:

gcloud org-policies enable-enforce constraints/storage.publicAccessPrevention --organization=ORGANIZATION_ID

For a bucket that must stay public, do not enforce it on that bucket. Google advises disabling it on that bucket's project instead.

6. Keep it that way

Buckets set to inherited follow the organization policy, so check that new buckets are not set differently. Revisit the list of exceptions regularly.

These commands are read-only.

Show the status of one bucket:

gcloud storage buckets describe gs://BUCKET_NAME --format="default(public_access_prevention)"
gcloud storage buckets describe gs://BUCKET_NAME --format="default(uniform_bucket_level_access)"

You want public_access_prevention:enforced (or inherited with the organization policy enforced) and uniform_bucket_level_access: true.

Show the effective organization policy:

gcloud org-policies describe constraints/storage.publicAccessPrevention --effective --organization=ORGANIZATION_ID

Look at who has access to a bucket:

gcloud storage buckets get-iam-policy gs://BUCKET_NAME

No binding should name allUsers or allAuthenticatedUsers unless the bucket is a deliberate exception. Finally, request an object URL from a browser that is not signed in: it should fail with a 401 or 403.

• Enforcing before looking for dependants. Websites, downloads and partner integrations that use public objects start failing.
• Assuming the old grants are gone. They are only overridden. Remove them, or they come back if the prevention is switched off.
• Enabling uniform bucket-level access with ACL users around. People with object-ACL-only access lose it, and ACL requests return 400.
• Expecting instant effect. Enforcement takes up to 10 minutes, and cached objects can stay on the internet for their Cache-Control time.
• Relying on the bucket flag in a project without an organization. Organization policies need an organization, so set the bucket-level flag instead.
• Forgetting the 90-day rule. Uniform bucket-level access cannot be turned off after it has been active for 90 consecutive days.

ConfigCobra is read-only and never changes your Google Cloud environment. It uses a read-only service account with viewer-level roles, across every project in the organization or a list you pick, and scans every connected cloud automatically every day. Findings for the CIS Google Cloud Platform Foundation Benchmark v5.0.0 (93 controls) point at the exact resource, and the Google Cloud inventory lists the resources in scope. Before you apply a fix, remediation impact analysis shows the affected resources and identities. You are alerted if a control regresses. The related checks below cover public buckets, uniform bucket-level access and alerts on storage permission changes.