Which Effect Does Enforcing Public Access Prevention Have on Existing IAM Bindings?

Answer

Enabling publicAccessPrevention=enforced on a Cloud Storage bucket does not delete any existing IAM bindings that grant allUsers or allAuthenticatedUsers access. Those bindings remain in the bucket’s policy; the PAP setting simply rejects requests from those principals until the flag is changed back to inherited.

Why This Matters

Because the policy is not altered, a later switch to inherited will immediately expose the bucket again if any public bindings were left in place. This can lead to accidental data exposure.

Typical Verification Flow

1. Create a test bucket:

   gsutil mb -p YOUR_PROJECT gs://demo-bucket/

2. Add a public IAM binding:

   gsutil iam ch allUsers:objectViewer gs://demo-bucket/

3. Confirm public access (e.g., curl -I https://storage.googleapis.com/demo-bucket/object.txt returns 200).
4. Enable PAP:

   gsutil retention set -b gs://demo-bucket/

   (or via console: set publicAccessPrevention=ENFORCED).
5. Repeat the public request; it should now return 403 Forbidden.
6. Check the policy to verify the binding still exists:

   gsutil iam get gs://demo-bucket/ | grep allUsers

7. Switch PAP back to inherited and re‑test; access is restored.

Missing Diagnostic Detail

Do you have Uniform Bucket‑Level Access enabled on the bucket? The presence or absence of this setting can affect how public IAM bindings are evaluated.