Other Articles

Cloud Storage – Restrict Public Access

This check ensures that public access to storage buckets is disabled to protect data from unauthorized exposure. Restricting public access helps prevent unauthorized data exposure and accidental data leaks.

Check Details

  • Resource: Storage
  • Check: Prevent Public Access to Storage Bucket.
  • Risk: Publicly accessible buckets may expose sensitive or confidential data to unauthorized users, leading to data breaches and compliance violations.

Remediation via Google Cloud Console

  1. Log in to the Google Cloud Console and navigate to Buckets. GCP Storage browser
  2. Click on the affected bucket name to open the bucket details page.
  3. Navigate to the Permissions tab and prevent public access. Bucket permissions tab
  4. Identify any role bindings assigned to allUsers or allAuthenticatedUsers.
  5. Click Delete next to each allUsers or allAuthenticatedUsers entry to remove public access.

Remediation via Google Cloud CLI

  1. Open the Google Cloud Console and launch Cloud Shell. GCP Cloud Shell
  2. Remove anonymous public access from the bucket:
    
    gsutil iam ch -d allUsers gs://<BUCKET_NAME>
    
  3. Remove authenticated public access from the bucket:
    
    gsutil iam ch -d allAuthenticatedUsers gs://<BUCKET_NAME>
    

Replace <BUCKET_NAME> with the name of the affected Cloud Storage bucket.

Prevention

You can prevent Cloud Storage buckets from becoming publicly accessible by enforcing the Domain Restricted Sharing organization policy.

Configure the policy from: IAM & Admin → Organization Policies → Domain restricted sharing

Default Value

By default, Google Cloud Storage buckets are not publicly accessible and do not allow anonymous access unless explicitly configured.