Back to Checks
gcp

Cloud Storage bucket has Soft Delete enabled

cloudstorage_bucket_soft_delete_enabled
Service: cloudstorageSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:storage.googleapis.com/Bucket

Google Cloud Storage buckets are assessed for Soft Delete being enabled with a non-zero retention window, meaning deleted objects are temporarily preserved and can be restored until the window expires.

Prowler logoProwlerprowler-provider-gcp

Risk

No Soft Delete makes object deletions immediate and irreversible, undermining data availability and integrity. Accidental removal, compromised credentials, wiper malware, or misconfigured lifecycle rules can erase datasets with no recovery path, breaking RPO/RTO and legal retention expectations.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudstorage_bucket_soft_delete_enabled

Recommendation

Enable Soft Delete with a retention window aligned to your RPO/RTO. Apply least privilege for delete/undelete actions and use defense in depth with object versioning and retention policies. Monitor deletion events and regularly test restore procedures to ensure recoverability.

Remediation

CLI

gcloud storage buckets update gs://<BUCKET_NAME> --soft-delete-duration=<SECONDS>

Terraform

resource "google_storage_bucket" "<example_resource_name>" {
  name     = "<example_resource_id>"
  location = "<LOCATION>"

  soft_delete_policy {
    retention_duration_seconds = 604800 # Critical: >0 enables Soft Delete (7 days)
  }
}

Other

1In Google Cloud Console, go to Storage > Buckets and open <BUCKET_NAME>
2Click the Configuration tab
3In the Soft Delete section, click Enable Soft Delete
4Set a retention duration > 0 and click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudstorage.cloudstorage_client import (
    cloudstorage_client,
)


class cloudstorage_bucket_soft_delete_enabled(Check):
    """
    Ensure Cloud Storage buckets have Soft Delete enabled.

    Reports PASS if a bucket has Soft Delete enabled (retentionDurationSeconds > 0),
    otherwise FAIL.
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []
        for bucket in cloudstorage_client.buckets:
            report = Check_Report_GCP(metadata=self.metadata(), resource=bucket)
            report.status = "FAIL"
            report.status_extended = (
                f"Bucket {bucket.name} does not have Soft Delete enabled."
            )

            if bucket.soft_delete_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"Bucket {bucket.name} has Soft Delete enabled."
                )

            findings.append(report)
        return findings

References