Menu
Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-gcp-foundations-5-1The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Showing SKILL.md
Based on SOC occupation classification
| name | cis-gcp-foundations-5.1 |
| description | Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible |
| category | cis-gcp-foundations |
| version | 4.0.0 |
| author | cyberstrike-official |
| tags | ["cis","gcp","storage","cloud-storage"] |
| cis_id | 5.1 |
| cis_benchmark | CIS Google Cloud Platform Foundation Benchmark v4.0.0 |
| tech_stack | ["gcp"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
It is recommended that IAM policy on Cloud Storage bucket does not allows anonymous or public access.
Allowing anonymous or public access grants permissions to anyone to access bucket content. Such access might not be desired if you are storing any sensitive data. Hence, ensure that anonymous or public access to a bucket is not allowed.
No storage buckets would be publicly accessible. You would have to explicitly administer bucket access.
Storage browser by visiting https://console.cloud.google.com/storage/browser.Bucket details page.Permissions tab.allUsers and allAuthenticatedUsers are not in the Members list.gsutil ls
gsutil iam get gs://BUCKET_NAME
No role should contain allUsers and/or allAuthenticatedUsers as a member.
Get https://www.googleapis.com/storage/v1/b?project=<ProjectName>
GET https://www.googleapis.com/storage/v1/b/<bucketName>/iam
No role should contain allUsers and/or allAuthenticatedUsers as a member.
Storage browser by visiting https://console.cloud.google.com/storage/browser.Bucket details page.Permissions tab.Delete button in front of and to remove that particular role assignment.allUsersallAuthenticatedUsersRemove allUsers and allAuthenticatedUsers access.
gsutil iam ch -d allUsers gs://BUCKET_NAME
gsutil iam ch -d allAuthenticatedUsers gs://BUCKET_NAME
You can prevent Storage buckets from becoming publicly accessible by setting up the Domain restricted sharing organization policy at:
https://console.cloud.google.com/iam-admin/orgpolicies/iam-allowedPolicyMemberDomains
By Default, Storage buckets are not publicly shared.
To implement Access restrictions on buckets, configuring Bucket IAM is preferred way than configuring Bucket ACL. On GCP console, "Edit Permissions" for bucket exposes IAM configurations only. Bucket ACLs are configured automatically as per need in order to implement/support User enforced Bucket IAM policy. In-case administrator changes bucket ACL using command-line(gsutils)/API bucket IAM also gets updated automatically.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.3 Configure Data Access Control Lists | x | x | |
| v7 | 12.4 Deny Communication over Unauthorized Ports | x | x |