Check for Publicly Accessible Cloud Storage Buckets

01 Sign in to Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

03 Navigate to Cloud Storage console available at https://console.cloud.google.com/storage.

04 In the navigation panel, select Buckets to access the list with all the Cloud Storage buckets created for the selected project.

05 Click on the name of the storage bucket that you want to examine, listed in the Name column.

06 Select the PERMISSIONS tab to access the permissions defined for selected bucket.

07 Select the VIEW BY PRINCIPALS tab and check the Principal column for any allUsers and allAuthenticatedUsers IAM principals. If the list contains one or more allUsers/allAuthenticatedUsers principals, the selected Google Cloud Storage bucket is publicly accessible. When your bucket is publicly accessible, the Cloud Storage console will also display the following message: Public to internet: This bucket is publicly accessible because allUsers or allAuthenticatedUsers have one or more permissions. Remove these principals to stop public access.

08 Repeat steps no. 5 – 7 for each storage bucket available within the selected project.

09 Repeat steps no. 2 – 8 for each project deployed in your Google Cloud account.

01 Run projects list command (Windows/macOS/Linux) using custom query filters to list the IDs of all the Google Cloud Platform (GCP) projects available in your cloud account:

gcloud projects list
  --format="table(projectId)"

02 The command output should return the requested GCP project IDs:

PROJECT_ID
cc-project5-123123
cc-web-project-112233
cc-mobile-project-111222

03 Run gsutil ls command (using gsutil Python tool) to list the identifier (name) of each storage bucket created for the specified GCP project:

gsutil ls -p cc-project5-123123

04 The command output should return the requested resource identifier(s):

gs://cc-webdata-bucket/
gs://cc-project5-123123.appspot.com/

05 Run gsutil iam ch command (using gsutil tool) using the name of the Cloud Storage bucket that you want to examine as the identifier parameter and custom query filters to describe name of the IAM member(s) associated with the selected bucket:

gsutil iam get gs://cc-webdata-bucket/
  --format=json | jq '.bindings[].members[]'

06 The command output should return the name of the associated member(s):

"projectOwner:cc-project5-123123"
"allAuthenticatedUsers"
"allUsers"

07 Repeat steps no. 5 and 6 for each storage bucket created for the selected project.

08 Repeat steps no. 3 – 7 for each project available within your Google Cloud account.

01 Sign in to Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

03 Navigate to Cloud Storage console available at https://console.cloud.google.com/storage.

04 In the navigation panel, select Buckets to access the list with all the Cloud Storage buckets created for the selected project.

05 Click on the name of the storage bucket that you want to configure, listed in the Name column.

06 Select the PERMISSIONS tab to access the permissions defined for selected bucket.

07 Select the VIEW BY PRINCIPALS tab to display all IAM members (principals) that have access to the selected resource.

08 Select all the allUsers and allAuthenticatedUsers principals available and choose REMOVE ACCESS to initiate the removal action for the selected bindings.

09 On the removal confirmation box, choose CONFIRM to remove the allUsers and/or allAuthenticatedUsers principals.

10 You can also choose PREVENT PUBLIC ACCESS from the Public access section to revoke all public access to your bucket and its objects. Choose CONFIRM to apply the changes. This setting overrides public access on existing objects. Before enabling this setting, ensure that none of your workloads will be interrupted by this policy.

11 Repeat steps no. 5 – 10 for each storage bucket created within the selected project.

12 Repeat steps no. 2 – 11 for each project deployed in your Google Cloud account.

01 Run gsutil iam ch -d command (using gsutil Python tool) using the name of the publicly accessible Cloud Storage bucket that you want to configure as the identifier parameter, to remove the allUsers binding from the IAM policy associated with the selected bucket (the command request does not produce an output):

gsutil iam ch -d allUsers gs://cc-webdata-bucket/

02 Run gsutil iam ch -d command (using gsutil tool) using the name of the publicly accessible storage bucket that you want to reconfigure as the identifier parameter, to remove the allAuthenticatedUsers member binding from the IAM policy associated with the selected bucket (the command does not return an output):

gsutil iam ch -d allAuthenticatedUsers gs://cc-webdata-bucket/

03 Repeat steps no. 1 and 2 for each anonymously or publicly accessible bucket available in the selected project.

04 Repeat steps no. 1 – 3 for each project created within your Google Cloud account.