Which Effect Does Enforcing Public Access Prevention Have on Existing IAM Bindings?

Goal

Determine whether enabling the publicAccessPrevention flag on a Cloud Storage bucket actively removes any pre‑existing bindings that grant allUsers or allAuthenticatedUsers access, or if those bindings persist and are merely blocked by the enforcement layer.

Constraints & Uncertainty

The documentation states that enforced Public Access Prevention rejects requests from public principals, but it does not explicitly state whether the underlying IAM policy is modified. This distinction is critical when a bucket’s setting is later changed back to inherited; a lingering public binding could unintentionally re‑expose the bucket.

Questions

• When publicAccessPrevention is set to enforced, does Google Cloud Storage strip existing allUsers or allAuthenticatedUsers IAM bindings from the bucket policy, or do those bindings remain while access is blocked?
• If the flag is later switched back to inherited, will the bucket automatically become publicly accessible again due to the retained bindings?