Cloud Storage bucket has a lifecycle management rule

Check ID: cloudstorage_bucket_lifecycle_management_enabled
Provider: GCP
Service: cloudstorage
Severity: LOW
Resource type: storage.googleapis.com/Bucket

What this check verifies

Cloud Storage buckets use Object Lifecycle Management with at least one valid rule (supported action and non-empty condition) to automatically transition storage class or delete objects.

Risk

Without lifecycle rules, data and object versions persist indefinitely, expanding the attack surface and hindering mandated erasure. Stale data amplifies exfiltration impact (confidentiality) and complicates integrity controls, while also driving avoidable cost and retention noncompliance.

Recommendation

Define lifecycle policies by data classification to enforce least data retention. Use Delete for TTL/age and SetStorageClass for archival, with version-aware conditions like isLive=false or numNewerVersions. Test on a limited dataset, review regularly, and align with defense in depth.

Remediation

CLI
Terraform
Dashboard steps

gcloud storage buckets update gs://<BUCKET_NAME> --lifecycle-file=<PATH_TO_JSON>

resource "google_storage_bucket" "<example_resource_name>" {
  name     = "<example_resource_name>"
  location = "US"

  # Critical: add at least one lifecycle rule with a condition to pass the check
  lifecycle_rule {
    action { type = "Delete" }      # Critical: defines a supported action
    condition { age = 1 }            # Critical: ensures the rule has a valid condition
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudstorage_bucket_lifecycle_management_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Data Access audit logs are enabled for Cloud Storage Cloud Storage log bucket has a locked retention policy

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires