| name | gcp-storage-public-access |
| description | Authorized assessment and hardening of Google Cloud Storage (GCS) public exposure: allUsers / allAuthenticatedUsers IAM, uniform bucket-level access, public access prevention, legacy ACLs vs IAM, and org-policy guardrails. Use when reviewing org-owned buckets or written engagements — not unauthorized enumeration of third-party GCS buckets.
|
GCS Public Access (Authorized Hardening)
Assess and harden Google Cloud Storage so buckets and objects are not
anonymously readable or listable unless that is explicit product intent.
Defensive methodology for owned or explicitly authorized GCP only.
Scope And Authorization
- In scope: buckets/projects you own or are contracted to assess;
read-only IAM/metadata/org policy; controlled PAP/UBLA/IAM changes with approval.
- Out of scope: mass scanning foreign GCS; bulk download of out-of-scope
objects; abusing leaked HMAC/SA keys on third-party projects.
- Prefer policy/metadata evidence over bulk download. Redact PII paths,
signed URLs, HMAC/SA keys. Public sensitive data → IR: remove public
principals, enforce PAP, rotate secrets (
secrets-management-hygiene), audit logs.
When To Use
- GCS public buckets, anonymous object URLs, or CDN origins on GCS
- IAM members
allUsers / allAuthenticatedUsers on bucket or object
- Missing/weak public access prevention (bucket or org constraint)
- Uniform bucket-level access off; mixed legacy ACLs and IAM
- Mentions: GCS public, allUsers, UBLA, PAP, anonymous
storage.objects.get
Do not use as primary for:
| Need | Skill instead |
|---|
| Project/org IAM, SA keys, actAs | gcp-iam-basics |
| AWS S3 BPA / policies / ACLs | aws-s3-bucket-hardening |
| Azure Blob anonymous / SAS | azure-blob-misconfig |
| Secrets, SA JSON, HMAC rotation | secrets-management-hygiene |
| Multi-cloud Terraform baseline | terraform-security-basics |
| Estate inventory / test plan | recon-and-methodology |
| App/IaC implementation quality | code-quality-standards |
Control Themes
| Control | Weak outcome | Hardened default |
|---|
| Public principals | Anyone reads/lists | No allUsers / allAuthenticatedUsers on private data |
| Public access prevention | Accidental public IAM | PAP enforced (bucket + org) |
| Uniform bucket-level access | Per-object ACL drift | UBLA on; IAM only |
| Legacy ACLs | AllUsers READER/OWNER | Clear public ACLs; migrate to IAM |
| Intentional public assets | Mixed with backups/PII | Dedicated public bucket only |
| Logging / versioning | Weak IR/recovery | Soft delete/versioning; access logs |
Public by design must be explicit — never mix with state, logs, or private uploads.
Workflow
1. Inventory
Confirm authorization. List buckets with purpose, sensitivity, consumers.
Incomplete estate → recon-and-methodology first.
gcloud config get-value project
gcloud storage buckets list --format="table(name,location,uniform_bucket_level_access,public_access_prevention)"
2. Public principals and exposure
BUCKET=gs://example-app-prod-data
gcloud storage buckets describe "$BUCKET" --format=json
gcloud storage buckets get-iam-policy "$BUCKET" --format=json
gcloud storage buckets describe "$BUCKET" --format="yaml(acl,defaultObjectAcl)"
| Finding | Signal |
|---|
allUsers + objectViewer / legacyObjectReader | Anonymous object read |
allUsers + list / legacyBucketReader | Anonymous enumeration |
allAuthenticatedUsers on private data | Any Google account |
| PAP not enforced + public binding | Accidental public risk |
| UBLA off + AllUsers object ACLs | Hidden per-object public |
Approved vantage only: non-destructive canary HEAD/GET and unauthenticated list;
record status — no bulk exfil.
3. Harden and verify
- Remove public IAM members; clear public ACLs if UBLA still off.
- Enable UBLA; set PAP enforced (org constraint when in scope).
- Isolate intentional static assets; document owner + review date.
- Versioning/soft-delete + access logs for sensitive data; alert on public IAM.
- Broader identity plane →
gcp-iam-basics. Secrets → secrets-management-hygiene.
- IaC/apps →
terraform-security-basics + code-quality-standards.
- Re-test anonymous deny; re-check IAM and
public_access_prevention.
Routing
| Situation | Primary | Helper |
|---|
| GCS public, allUsers, UBLA, PAP, ACL vs IAM | This skill | — |
| Broader GCP IAM / SA keys | gcp-iam-basics | this skill (bucket public) |
| AWS S3 public access | aws-s3-bucket-hardening | — |
| Azure Blob public / SAS | azure-blob-misconfig | — |
| Secret/HMAC/SA key leak | secrets-management-hygiene | this skill (revoke public) |
| Terraform GCS / state hygiene | terraform-security-basics | this skill (live checks) |
| App/IaC code changes | code-quality-standards | this skill (control intent) |
| Project discovery plan | recon-and-methodology | this skill (bucket controls) |
Hand off other clouds to aws-s3-bucket-hardening / azure-blob-misconfig.
This skill owns GCS data-plane public exposure; gcp-iam-basics owns project/org IAM.
Output Checklist
Rules
- Owned or authorized GCP only — no third-party bucket hunting or exfil.
- Prove exposure with IAM/ACL/PAP metadata and minimal canary checks.
- Public access must be explicit product intent, not leftover ACL/IAM.
