Check ID:
Provider: GCP
Service:
Severity: CRITICAL
Categories:
Resource type:
cloudstorage_bucket_public_accessProvider: GCP
Service:
cloudstorageSeverity: CRITICAL
Categories:
internet-exposedResource type:
storage.googleapis.com/BucketWhat this check verifies
Cloud Storage buckets are assessed for anonymous or public access by detecting permissions granted to broad principals likeallUsers or allAuthenticatedUsers that make bucket data reachable without authentication.
Risk
Public buckets undermine confidentiality and integrity. Anyone can list or download objects; if write access exists, content can be overwritten or deleted. Abuse enables hotlinking and malware hosting, impacting availability and driving unexpected egress costs.Recommendation
Adopt least privilege: removeallUsers/allAuthenticatedUsers and grant only required identities. Enforce Public Access Prevention and use uniform bucket-level access. If external sharing is needed, issue signed URLs or use an authenticated proxy/CDN, and review permissions regularly.
Remediation
- CLI
- Terraform
- Dashboard steps
gcloud storage buckets update gs://<example_resource_name> —public-access-prevention enforced
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudStorage/publicly-accessible-storage-buckets.html
- https://docs.cloud.google.com/storage/docs/public-access-prevention
- https://docs.cloud.google.com/storage/docs/access-control/iam
- https://docs.cloud.google.com/storage/docs/access-control/iam-reference
- https://docs.cloud.google.com/storage/docs/using-uniform-bucket-level-access
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = cloudstorage_bucket_public_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks