Back to Checks
gcp

Cloud Storage bucket is not publicly accessible

cloudstorage_bucket_public_access
Service: cloudstorageSeverity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:storage.googleapis.com/Bucket

Cloud Storage buckets are assessed for anonymous or public access by detecting permissions granted to broad principals like allUsers or allAuthenticatedUsers that make bucket data reachable without authentication.

Prowler logoProwlerprowler-provider-gcp

Risk

Public buckets undermine confidentiality and integrity. Anyone can list or download objects; if write access exists, content can be overwritten or deleted. Abuse enables hotlinking and malware hosting, impacting availability and driving unexpected egress costs.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudstorage_bucket_public_access

Recommendation

Adopt least privilege: remove allUsers/allAuthenticatedUsers and grant only required identities. Enforce Public Access Prevention and use uniform bucket-level access. If external sharing is needed, issue signed URLs or use an authenticated proxy/CDN, and review permissions regularly.

Remediation

CLI

gcloud storage buckets update gs://<example_resource_name> --public-access-prevention enforced

Terraform

resource "google_storage_bucket" "<example_resource_name>" {
  name     = "<example_resource_name>"
  location = "<LOCATION>"

  public_access_prevention = "enforced" # Critical: blocks allUsers/allAuthenticatedUsers, making the bucket not publicly accessible
}

Other

1In Google Cloud Console, go to Storage > Buckets and open <example_resource_name>
2Click the Permissions tab
3Set Public access prevention to Enforced
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudstorage.cloudstorage_client import (
    cloudstorage_client,
)


class cloudstorage_bucket_public_access(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for bucket in cloudstorage_client.buckets:
            report = Check_Report_GCP(metadata=self.metadata(), resource=bucket)
            report.status = "PASS"
            report.status_extended = f"Bucket {bucket.name} is not publicly accessible."
            if bucket.public:
                report.status = "FAIL"
                report.status_extended = f"Bucket {bucket.name} is publicly accessible."
            findings.append(report)

        return findings

References