Use public access prevention (original) (raw)

Overview

This page describes how to use the public access prevention bucket setting and the public access prevention organization policy constraint. Public access prevention lets you restrict public access to your buckets and objects.

Before you begin

Before using public access prevention in Cloud Storage, make sure you have the required IAM role and review the considerations for enforcing public access prevention.

Get required roles

To manage the public access prevention organization policy at the project, folder, or organization level, ask your administrator to grant you the Organization Policy Administrator (roles/orgpolicy.policyAdmin) role on the organization. This predefined role contains the permissions required to manage public access prevention at the project, folder, or organization level. For information about the permissions that are included in this role, refer todetails about the Organization Administrator role.

To manage the public access prevention setting on a bucket, ask your administrator to grant you the Storage Admin (roles/storage.admin) role on the bucket. This role contains the permissions required to manage public access prevention on a bucket. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

• storage.buckets.update
• storage.buckets.setIamPolicy

For information about the other permissions that are included in the Storage Admin role, refer todetails about the Storage Admin role.

Review considerations

Before you begin, it's recommended that you ensure no workflows break as a result of blocking public access. SeeConsiderations when enforcing on existing resources for more details.

Use the bucket setting

This section shows how to enforce and remove public access prevention for individual buckets, as well as how to check the status of individual buckets.

Set public access prevention

To change the public access prevention setting for an individual bucket:

Console

1. In the Google Cloud console, go to the Cloud Storage Buckets page.
   Go to Buckets
2. In the list of buckets, click the name of the bucket for which you want to enforce or remove public access prevention.
3. In the Bucket details page, click the Permissions tab.
4. In the Public access card, click Prevent public access to enforce public access prevention, or click Allow public access to remove public access prevention.
5. Click Confirm.

To learn how to get detailed error information about failed Cloud Storage operations in the Google Cloud console, seeTroubleshooting.

Command line

Use the gcloud storage buckets update command with the appropriate flag:

gcloud storage buckets update gs://BUCKET_NAME FLAG

Where:

• BUCKET_NAME is the name of the relevant bucket. For example, my-bucket.
• FLAG is either --public-access-prevention to enable public access prevention or --no-public-access-prevention to disable it.

If successful, the response looks similar to the following example:

Updating gs://my-bucket/... Completed 1

Client libraries

C++

For more information, see theCloud Storage C++ API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

The following sample enforces public access prevention on a bucket:

The following sample sets public access prevention to inherited for a bucket:

C#

For more information, see theCloud Storage C# API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

The following sample enforces public access prevention on a bucket:

The following sample sets public access prevention to inherited for a bucket:

Go

For more information, see theCloud Storage Go API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

The following sample enforces public access prevention on a bucket:

The following sample sets public access prevention to inherited for a bucket:

Java

For more information, see theCloud Storage Java API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

The following sample enforces public access prevention on a bucket:

The following sample sets public access prevention to inherited for a bucket:

Node.js

For more information, see theCloud Storage Node.js API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

The following sample enforces public access prevention on a bucket:

The following sample sets public access prevention to inherited for a bucket:

PHP

For more information, see theCloud Storage PHP API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

The following sample enforces public access prevention on a bucket:

The following sample sets public access prevention to inherited for a bucket:

Python

For more information, see theCloud Storage Python API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

The following sample enforces public access prevention on a bucket:

The following sample sets public access prevention to inherited for a bucket:

Ruby

For more information, see theCloud Storage Ruby API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

The following sample enforces public access prevention on a bucket:

The following sample sets public access prevention to inherited for a bucket:

REST APIs

JSON API

1. Have gcloud CLI installed and initialized, which lets you generate an access token for the Authorization header.
2. Create a JSON file that contains the following information:
   {
   "iamConfiguration": {
   "publicAccessPrevention": "STATE",
   }
   }
   Where <var>STATE</var> is either enforced or inherited.
3. Use cURL to call the JSON API with a PATCH Bucketrequest that includes the desired fields:
   curl -X PATCH --data-binary @JSON_FILE_NAME \
   -H "Authorization: Bearer $(gcloud auth print-access-token)" \
   -H "Content-Type: application/json" \
   "https://storage.googleapis.com/storage/v1/b/BUCKET_NAME?fields=iamConfiguration"
   Where:
   • JSON_FILE_NAME is the path for the JSON file that you created in the previous step.
   • BUCKET_NAME is the name of the relevant bucket. For example, my-bucket.

XML API

The XML API cannot be used to manage public access prevention. Use one of the other Cloud Storage tools, such as the Google Cloud console, instead.

View public access prevention status

To view the public access prevention status for an individual bucket:

Console

1. In the Google Cloud console, go to the Cloud Storage Buckets page.
   Go to Buckets
2. Click the name of the bucket for which you want to view the public access prevention status.
3. Click the Permissions tab.
4. The Public access card shows the status for your bucket.

To learn how to get detailed error information about failed Cloud Storage operations in the Google Cloud console, seeTroubleshooting.

Command line

Use the gcloud storage buckets describe command with the--format flag:

gcloud storage buckets describe gs://BUCKET_NAME --format="default(public_access_prevention)"

Where BUCKET_NAME is the name of the bucket whose status you want to view. For example, my-bucket.

If successful, the response looks similar to the following example:

public_access_prevention:inherited

Client libraries

C++

For more information, see theCloud Storage C++ API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

C#

For more information, see theCloud Storage C# API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Go

For more information, see theCloud Storage Go API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Java

For more information, see theCloud Storage Java API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Node.js

For more information, see theCloud Storage Node.js API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

PHP

For more information, see theCloud Storage PHP API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Python

For more information, see theCloud Storage Python API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Ruby

For more information, see theCloud Storage Ruby API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

REST APIs

JSON API

1. Have gcloud CLI installed and initialized, which lets you generate an access token for the Authorization header.
2. Use cURL to call the JSON API with a GET Bucketrequest that includes the desired fields:
   curl -X GET -H "Authorization: Bearer $(gcloud auth print-access-token)" \
   "https://storage.googleapis.com/storage/v1/b/BUCKET_NAME?fields=iamConfiguration"
   Where BUCKET_NAME is the name of the relevant bucket. For example, my-bucket.
   The response looks like the following example:
   {
   "iamConfiguration": {
   ...
   "publicAccessPrevention": "FLAG"
   }
   }
   Where FLAG is either inherited or enforced.

XML API

The XML API cannot be used to manage public access prevention. Use one of the other Cloud Storage tools, such as the Google Cloud console, instead.

Use the organization policy

This section shows how to enforce and remove the public access prevention organization policy, as well as how to check the status of the policy.

Set public access prevention

To set public access prevention at the project, folder, or organization level:

Console

Follow the instructions at Creating and managing organization policiesusing the storage.publicAccessPrevention constraint.

To learn how to get detailed error information about failed Cloud Storage operations in the Google Cloud console, seeTroubleshooting.

Command line

Use the gcloud beta resource-manager org-policies command:

gcloud beta resource-manager org-policies STATE
constraints/storage.publicAccessPrevention
--RESOURCE RESOURCE_ID

Where:

• STATE can have the following values:
  • enable-enforce: Enforce public access prevention for the resource.
  • disable-enforce: Disable public access prevention for the resource.
  • delete: Remove the organization policy constraint from the resource, so that the resource inherits the value of its parent resource.
• RESOURCE is the resource for which you want to set public access prevention. For example, organization, project, or folder.
• RESOURCE_ID is the ID for resource. For example,123456789012 for an organization ID, 245321 for a folder ID, or my-pet-project for a project ID.

See Using constraints for more instructions.

The following is an example of the output when you use disable-enforce:

etag: BwVJi0OOESU= booleanPolicy: {} constraint: constraints/storage.publicAccessPrevention

View public access prevention status

To view the public access prevention status at the project, folder, organization level:

Console

Follow the instructions at Creating and managing organization policiesusing the storage.publicAccessPrevention constraint.

To learn how to get detailed error information about failed Cloud Storage operations in the Google Cloud console, seeTroubleshooting.

Command line

Use the describe --effective command:

gcloud beta resource-manager org-policies describe
constraints/storage.publicAccessPrevention --effective
--RESOURCE RESOURCE_ID

Where:

• RESOURCE is the resource for which you want to view the public access prevention status. For example, organization,project, or folder.
• RESOURCE_ID is the ID for the resource. For example, 123456789012 for an organization ID, 245321for a folder ID, and my-pet-project for a project ID.

See Using constraints for more instructions.

What's next

• Learn more about public access prevention.