Back to Checks
gcp

Cloud Storage bucket has uniform bucket-level access enabled

cloudstorage_bucket_uniform_bucket_level_access
Service: cloudstorageSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:storage.googleapis.com/Bucket

Cloud Storage buckets have uniform bucket-level access (UBLA) enabled so object permissions are controlled solely by bucket-level IAM, with object ACLs disabled.

Prowler logoProwlerprowler-provider-gcp

Risk

Without UBLA, object ACLs can bypass bucket IAM, enabling unintended public reads or unauthorized writes. This threatens confidentiality through data exposure, undermines integrity via object tampering, and reduces auditability with fragmented, hard-to-review permissions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudstorage_bucket_uniform_bucket_level_access

Recommendation

Enable UBLA on all buckets to centralize authorization and apply least privilege with IAM. Eliminate reliance on object ACLs; use Public Access Prevention and organization policies to enforce non-public defaults. Monitor access with logs and periodic reviews as part of defense in depth.

Remediation

CLI

gcloud storage buckets update gs://<example_resource_name> --uniform-bucket-level-access

Terraform

resource "google_storage_bucket" "<example_resource_name>" {
  name     = "<example_resource_name>"
  location = "<LOCATION>"

  uniform_bucket_level_access = true # Critical: enables UBLA so the bucket passes the check
}

Other

1In Google Cloud Console, go to Storage > Buckets
2Click the bucket name (<example_resource_name>)
3Open the Permissions tab (or Configuration if shown)
4In Access control, select Uniform and click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudstorage.cloudstorage_client import (
    cloudstorage_client,
)


class cloudstorage_bucket_uniform_bucket_level_access(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for bucket in cloudstorage_client.buckets:
            report = Check_Report_GCP(metadata=self.metadata(), resource=bucket)
            report.status = "PASS"
            report.status_extended = (
                f"Bucket {bucket.name} has uniform Bucket Level Access enabled."
            )
            if not bucket.uniform_bucket_level_access:
                report.status = "FAIL"
                report.status_extended = (
                    f"Bucket {bucket.name} has uniform Bucket Level Access disabled."
                )
            findings.append(report)

        return findings

References