Uniform bucket-level access vs ACLs: How to avoid accidental public exposure?

Answer

Turn on uniform bucket‑level access, then verify that no object ACL grants public read, migrate any required public permissions to IAM, and finally audit the bucket to confirm the transition.

1. Verify no public ACLs after enabling uniform access

1. Enable the feature (if not already on):

   gsutil uniformbucketlevelaccess set on gs://YOUR_BUCKET

2. Confirm the setting:

   gsutil uniformbucketlevelaccess get gs://YOUR_BUCKET

   The output should show Enabled: True.
3. Check that no object ACLs remain that grant public access:

   gsutil acl get gs://YOUR_BUCKET/* | grep -E 'allUsers|allAuthenticatedUsers'

   If the command returns nothing, no object has a public ACL. Any output indicates a remaining public grant.
4. Inspect the bucket IAM policy:

   gsutil iam get gs://YOUR_BUCKET

   Ensure that bindings for allUsers or allAuthenticatedUsers do not include roles that allow object read (e.g., roles/storage.objectViewer or roles/storage.legacyObjectReader).

2. Migrate existing public ACLs to IAM (if needed)

1. Identify objects that were publicly readable:

   gsutil acl get gs://YOUR_BUCKET/* | grep -E 'allUsers|allAuthenticatedUsers'

2. For each object, decide whether the public read is required. If it is, grant the equivalent IAM role at the bucket level instead of per‑object ACL:

   gsutil iam ch -u allUsers:roles/storage.objectViewer gs://YOUR_BUCKET

   (Use roles/storage.legacyObjectReader if you need legacy behavior.)
3. Remove the offending object ACLs:

   gsutil acl ch -d allUsers gs://YOUR_BUCKET/OBJECT_PATH
   gsutil acl ch -d allAuthenticatedUsers gs://YOUR_BUCKET/OBJECT_PATH

   Repeat for every object that had a public ACL.
4. Re‑run the verification steps above to confirm that no public ACLs remain and that the IAM policy reflects the intended access.

3. Audit and monitor the transition

• Enable Cloud Audit Logs for Storage and watch for storage.objects.get events from anonymous callers. Any such events after the change indicate unintended public reads.
• Use the metric storage.googleapis.com/object/request_count filtered by anonymous to spot unexpected traffic.
• Optionally, run a scheduled Cloud Function that executes the verification commands and alerts if any allUsers or allAuthenticatedUsers appear in ACLs or IAM.

Missing diagnostic detail

Do any of your workloads rely on per‑object ACLs for fine‑grained permissions? If so, those grants must be migrated to IAM before disabling object‑level ACLs, otherwise access will be broken.