Cloud Storage bucket has Soft Delete enabled

Check ID: cloudstorage_bucket_soft_delete_enabled
Provider: GCP
Service: cloudstorage
Severity: MEDIUM
Categories: resilience
Resource type: storage.googleapis.com/Bucket

What this check verifies

Google Cloud Storage buckets are assessed for Soft Delete being enabled with a non-zero retention window, meaning deleted objects are temporarily preserved and can be restored until the window expires.

Risk

No Soft Delete makes object deletions immediate and irreversible, undermining data availability and integrity. Accidental removal, compromised credentials, wiper malware, or misconfigured lifecycle rules can erase datasets with no recovery path, breaking RPO/RTO and legal retention expectations.

Recommendation

Enable Soft Delete with a retention window aligned to your RPO/RTO. Apply least privilege for delete/undelete actions and use defense in depth with object versioning and retention policies. Monitor deletion events and regularly test restore procedures to ensure recoverability.

Remediation

CLI
Terraform
Dashboard steps

gcloud storage buckets update gs://<BUCKET_NAME> --soft-delete-duration=<SECONDS>

resource "google_storage_bucket" "<example_resource_name>" {
  name     = "<example_resource_id>"
  location = "<LOCATION>"

  soft_delete_policy {
    retention_duration_seconds = 604800 # Critical: >0 enables Soft Delete (7 days)
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudstorage_bucket_soft_delete_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud Storage bucket is not publicly accessible Cloud Storage bucket has a sufficient retention period

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires