Back to Checks
gcp

Cloud Storage bucket has a sufficient Retention Policy period

cloudstorage_bucket_sufficient_retention_period
Service: cloudstorageSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:storage.googleapis.com/Bucket

Cloud Storage bucket has a bucket-level Retention Policy with a retentionPeriod that meets or exceeds the organization-defined minimum, preventing deletion or modification of objects before the required time.

Prowler logoProwlerprowler-provider-gcp

Risk

Insufficient or missing retention allows premature deletion or modification of objects, weakening data recovery and compliance with retention requirements.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudstorage_bucket_sufficient_retention_period

Recommendation

Define and apply a bucket-level Retention Policy that meets your minimum retention requirement (e.g., 90 or 365 days) to enforce data recoverability and compliance.

Remediation

CLI

gcloud storage buckets update gs://<BUCKET_NAME> --retention-period=<SECONDS>

Terraform

resource "google_storage_bucket" "example" {
  name     = var.bucket_name
  location = var.location

  retention_policy {
    retention_period = 7776000 # 90 days in seconds
  }
}

Other

11) Console → Storage → Buckets → <BUCKET_NAME>
22) Tab 'Configuration' → 'Retention policy'
33) Set the required retention period (e.g., 90 or 365 days) and save
44) (Optional) Lock the policy if required by compliance

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudstorage.cloudstorage_client import (
    cloudstorage_client,
)


class cloudstorage_bucket_sufficient_retention_period(Check):
    """
    Ensure there is a sufficient bucket-level retention period configured for GCS buckets.

    PASS: retentionPolicy.retentionPeriod >= min threshold (days)
    FAIL: no retention policy or period < threshold
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []

        min_retention_days = int(
            getattr(cloudstorage_client, "audit_config", {}).get(
                "storage_min_retention_days", 90
            )
        )

        for bucket in cloudstorage_client.buckets:
            report = Check_Report_GCP(metadata=self.metadata(), resource=bucket)

            retention_policy = bucket.retention_policy

            if retention_policy is None:
                report.status = "FAIL"
                report.status_extended = (
                    f"Bucket {bucket.name} does not have a retention policy "
                    f"(minimum required: {min_retention_days} days)."
                )
                findings.append(report)
                continue

            days = retention_policy.retention_period // 86400  # seconds to days

            if days >= min_retention_days:
                report.status = "PASS"
                report.status_extended = (
                    f"Bucket {bucket.name} has a sufficient retention policy of {days} days "
                    f"(minimum required: {min_retention_days})."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Bucket {bucket.name} has an insufficient retention policy of {days} days "
                    f"(minimum required: {min_retention_days})."
                )

            findings.append(report)

        return findings

References