Disable soft delete (original) (raw)

Skip to main content

Disable soft delete

Overview Usage

This page describes how to disable the soft delete feature on new and existing buckets across your organization.

Soft delete is enabled on new buckets by default to prevent data loss. If needed, you can disable soft delete for existing buckets by modifying the soft delete policy, and you can disable soft delete by default for new buckets by setting an organization-wide default tag. Note that once you disable soft delete, your deleted data cannot be recovered, including accidental or malicious deletions.

Required roles

To get the permissions that you need to disable soft delete, ask your administrator to grant you the following IAM roles on the organization level:

These predefined roles contain the permissions required to disable soft delete. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to disable soft delete:

For information about granting roles, seeSet and manage IAM policies on buckets or Manage access to projects.

Disable soft delete for a specific bucket

Before you begin, consider the following:

Use the following instructions to disable soft delete for a specific bucket:

Disable soft delete for the 100 largest buckets in a project

Using the Google Cloud console you can disable soft delete for up to 100 buckets at once, with buckets sorted by the most soft-deleted bytes or the highest ratio of soft-deleted bytes to live bytes, allowing you to manage buckets with the greatest impact to your soft delete costs.

  1. In the Google Cloud console, go to the Cloud Storage Buckets page.
    Go to Buckets
  2. In the Cloud Storage page, click Settings.
  3. Click the Soft delete tab.
  4. From the Top buckets by deleted bytes list, select the buckets you want to disable soft delete for.
  5. Click Turn off soft delete.
    Soft delete is disabled on the buckets you selected.

Disable soft delete for multiple or all buckets within a project

Using the Google Cloud CLI, run the gcloud storage buckets updatecommand with the --project flag and the * wildcard to bulk disable soft delete for multiple or all buckets within a project:

gcloud storage buckets update --project=PROJECT_ID --clear-soft-delete gs://*

Where:

Disable soft delete across all buckets within a folder

Using the Google Cloud CLI, run the gcloud projects list andgcloud storage buckets update commands to disable soft delete on buckets across all the projects in a specified folder.

Run the gcloud projects list and gcloud storage buckets updatecommands to list all the buckets under a specified folder and then disable soft delete for all buckets within the folder:

gcloud projects list --filter="parent.id: FOLDER_ID" --format="value(projectId)" | while read project do gcloud storage buckets update --project=$project --clear-soft-delete gs://* done

Where:

Disable soft delete at the organization level

Using the Google Cloud CLI, run the gcloud storage buckets updatecommand with the --clear-soft-delete flag and the * wildcard to disable soft delete at the organization level:

Run the gcloud storage buckets update command with the--clear-soft-delete flag and the * wildcard to disable soft delete for all buckets within your organization:

gcloud projects list --format="value(projectId)" | while read project do gcloud storage buckets update --project=$project --clear-soft-delete gs://* done

Cloud Storage disables soft delete on existing buckets. Objects that have already been soft deleted will remain in the buckets until their soft delete retention duration completes, after which, they are permanently deleted.

Disable soft delete for new buckets

While soft delete is enabled by default on new buckets, you can prevent soft delete from default enablement using tags. Tags use the storage.defaultSoftDeletePolicy key to apply a 0d (zero days) soft delete policy at the organization level, which disables the feature and prevents future retention of deleted data.

Use the following instructions to disable soft delete by default when you create new buckets. Note that the following instructions aren't equivalent to setting an organization policy that mandates a particular soft delete policy, meaning you can still enable soft delete on specific buckets by specifying a policy if needed.

  1. Using the Google Cloud CLI, create the storage.defaultSoftDeletePolicy tag which is used to change the default soft delete retention duration on new buckets. Note that only the storage.defaultSoftDeletePolicy tag name updates the default soft delete retention duration.
    Create a tag key using thegcloud resource-manager tags keys create command:
    gcloud resource-manager tags keys create storage.defaultSoftDeletePolicy \
    --parent=organizations/ORGANIZATION_ID \
    --description="Configures the default softDeletePolicy for new Storage buckets."
    Where:
    • ORGANIZATION_ID is the numeric ID of the organization you want to set a default soft delete retention duration for. For example, 12345678901. To learn how to find the organization ID, seeGetting your organization resource ID.
  2. Create a tag value for 0d (zero days) to disable the soft delete retention period by default on new buckets using the gcloud resource-manager tags values create command:
    gcloud resource-manager tags values create 0d \
    --parent=ORGANIZATION_ID/storage.defaultSoftDeletePolicy \
    --description="Disables soft delete for new Storage buckets."
    Where:
    • ORGANIZATION_ID is the numeric ID of the organization you want to set the default soft delete retention duration for. For example, 12345678901.
  3. Attach the tag to your resource using thegcloud resource-manager tags bindings create command:
    gcloud resource-manager tags bindings create \
    --tag-value=ORGANIZATION_ID/storage.defaultSoftDeletePolicy/0d \
    --parent=RESOURCE_ID
    Where:
    • ORGANIZATION_ID is the numeric ID of the organization under which the tag was created. For example,12345678901.
    • RESOURCE_ID is the full name of the organization you want to create the tag binding for. For example, to attach a tag to organizations/7890123456, enter//cloudresourcemanager.googleapis.com/organizations/7890123456.

Disable soft delete for buckets that exceed a specified cost threshold

Using the Cloud Client Libraries for Python, you can disable soft delete for buckets that exceed a specified relative cost threshold with a Python client library sample. The sample does the following:

  1. Calculates the relative cost of storage for each storage class.
  2. Assesses the soft delete cost accumulated by your buckets.
  3. Sets a cost threshold for soft delete usage and lists the buckets that exceed the threshold you set and lets you disable soft delete for the buckets that exceed the threshold.

To learn more about setting up the Python client library and using the sample, see theCloud Storage soft delete cost analyzer README.md page.

The following sample disables soft delete for buckets that exceed a specified cost threshold:

What's next

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-12-15 UTC.