Back to Checks
gcp

Cloud Storage bucket has lifecycle management enabled with at least one valid rule

cloudstorage_bucket_lifecycle_management_enabled
Service: cloudstorageSeverity: low
OfficialBuilt-inVerified
Resource Type:storage.googleapis.com/Bucket

Cloud Storage buckets use Object Lifecycle Management with at least one valid rule (supported action and non-empty condition) to automatically transition storage class or delete objects.

Prowler logoProwlerprowler-provider-gcp

Risk

Without lifecycle rules, data and object versions persist indefinitely, expanding the attack surface and hindering mandated erasure. Stale data amplifies exfiltration impact (confidentiality) and complicates integrity controls, while also driving avoidable cost and retention noncompliance.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudstorage_bucket_lifecycle_management_enabled

Recommendation

Define lifecycle policies by data classification to enforce least data retention. Use Delete for TTL/age and SetStorageClass for archival, with version-aware conditions like isLive=false or numNewerVersions. Test on a limited dataset, review regularly, and align with defense in depth.

Remediation

CLI

gcloud storage buckets update gs://<BUCKET_NAME> --lifecycle-file=<PATH_TO_JSON>

Terraform

resource "google_storage_bucket" "<example_resource_name>" {
  name     = "<example_resource_name>"
  location = "US"

  # Critical: add at least one lifecycle rule with a condition to pass the check
  lifecycle_rule {
    action { type = "Delete" }      # Critical: defines a supported action
    condition { age = 1 }            # Critical: ensures the rule has a valid condition
  }
}

Other

1In Google Cloud Console, go to Storage > Buckets and open <BUCKET_NAME>
2Click the Lifecycle tab
3Click Add a rule
4Action: Delete
5Condition: Age = 1 day
6Click Create/Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudstorage.cloudstorage_client import (
    cloudstorage_client,
)


class cloudstorage_bucket_lifecycle_management_enabled(Check):
    """Ensure Cloud Storage buckets have lifecycle management enabled with at least one valid rule.

    Reports PASS if a bucket has at least one valid lifecycle rule
    (with a supported action and condition), otherwise FAIL.

    """

    def execute(self) -> list[Check_Report_GCP]:
        """Run the lifecycle management check for each Cloud Storage bucket.

        Returns:
            list[Check_Report_GCP]: Results for all evaluated buckets.
        """

        findings = []
        for bucket in cloudstorage_client.buckets:
            report = Check_Report_GCP(metadata=self.metadata(), resource=bucket)
            report.status = "FAIL"
            report.status_extended = (
                f"Bucket {bucket.name} does not have lifecycle management enabled."
            )

            rules = bucket.lifecycle_rules

            if rules:
                valid_rules = []
                for rule in rules:
                    action_type = rule.get("action", {}).get("type")
                    condition = rule.get("condition")
                    if action_type and condition:
                        valid_rules.append(rule)

                if valid_rules:
                    report.status = "PASS"
                    report.status_extended = f"Bucket {bucket.name} has lifecycle management enabled with {len(valid_rules)} valid rule(s)."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Bucket {bucket.name} has lifecycle rules configured but none are valid."

            findings.append(report)
        return findings

References