Cloud Storage bucket has a sufficient retention period

Check ID: cloudstorage_bucket_sufficient_retention_period
Provider: GCP
Service: cloudstorage
Severity: MEDIUM
Categories: resilience
Resource type: storage.googleapis.com/Bucket

What this check verifies

Cloud Storage bucket has a bucket-level Retention Policy with a retentionPeriod that meets or exceeds the organization-defined minimum, preventing deletion or modification of objects before the required time.

Risk

Insufficient or missing retention allows premature deletion or modification of objects, weakening data recovery and compliance with retention requirements.

Recommendation

Define and apply a bucket-level Retention Policy that meets your minimum retention requirement (e.g., 90 or 365 days) to enforce data recoverability and compliance.

Remediation

CLI
Terraform
Dashboard steps

gcloud storage buckets update gs://<BUCKET_NAME> --retention-period=<SECONDS>

resource "google_storage_bucket" "example" {
  name     = var.bucket_name
  location = var.location

  retention_policy {
    retention_period = 7776000 # 90 days in seconds
  }
}

References

https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudStorage/sufficient-retention-period.html

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudstorage_bucket_sufficient_retention_period. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud Storage bucket has Soft Delete enabled Cloud Storage bucket has uniform bucket-level access enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires