Check ID:
Provider: GCP
Service:
Severity: MEDIUM
Categories:
Resource type:
cloudstorage_bucket_uniform_bucket_level_accessProvider: GCP
Service:
cloudstorageSeverity: MEDIUM
Categories:
identity-accessResource type:
storage.googleapis.com/BucketWhat this check verifies
Cloud Storage buckets have uniform bucket-level access (UBLA) enabled so object permissions are controlled solely by bucket-level IAM, with object ACLs disabled.Risk
Without UBLA, object ACLs can bypass bucket IAM, enabling unintended public reads or unauthorized writes. This threatens confidentiality through data exposure, undermines integrity via object tampering, and reduces auditability with fragmented, hard-to-review permissions.Recommendation
Enable UBLA on all buckets to centralize authorization and apply least privilege with IAM. Eliminate reliance on object ACLs; use Public Access Prevention and organization policies to enforce non-public defaults. Monitor access with logs and periodic reviews as part of defense in depth.Remediation
- CLI
- Terraform
- Dashboard steps
gcloud storage buckets update gs://<example_resource_name> —uniform-bucket-level-access
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudStorage/enable-uniform-bucket-level-access.html
- https://docs.cloud.google.com/storage/docs/using-uniform-bucket-level-access
- https://docs.cloud.google.com/storage/docs/public-access-prevention
- https://docs.cloud.google.com/storage/docs/access-control/iam
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = cloudstorage_bucket_uniform_bucket_level_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks