GCS buckets where Public Access Prevention is not enforced

What the evidence actually proves

Public Access Prevention is the bucket setting that makes allUsers and allAuthenticatedUsers grants impossible. ZopNight’s discoverer reads iamConfiguration.publicAccessPrevention during asset inventory and records whether it is enforced. The rule fires when it is not, and that is precisely all it proves. Nobody has inspected the bucket’s IAM policy, so the finding does not say “this bucket is public”. A bucket with PAP off and a clean policy leaks nothing today; what it lacks is the guardrail that stops one mistaken binding from publishing the contents tomorrow.

An earlier version of this rule claimed a confirmed allUsers binding. The claim was stronger than the evidence, so the recommendation was rewritten to match what the discoverer can prove: prevention is not enforced. The distinction matters when you triage: the finding is a missing safety interlock, rated critical because public GCS buckets remain one of the most common causes of cloud data breaches, not an alarm that exposure has already occurred.

Enforce prevention, then look for grants

Fixing individual bindings without turning on prevention leaves the door unlocked. The effective order is the reverse:

1. Enforce PAP on the bucket (existing public grants become inert immediately).
2. Then audit and delete any allUsers / allAuthenticatedUsers members from the policy.
3. Project-wide, set the org policy constraints/storage.publicAccessPrevention so new buckets inherit enforced and the class of finding stops recurring.

If the bucket genuinely serves a public website, mark the exception deliberately. Do not leave PAP as inherited by accident.

Verify a bucket from your terminal

gcloud storage buckets describe gs://BUCKET \
  --format="value(iamConfiguration.publicAccessPrevention)"

enforced is compliant. inherited means the bucket relies on whatever the org policy says, which, absent that policy, is nothing.

When the rule stays silent

Detection fires only on the discoverer’s explicit public_access_enabled flag being true. A bucket that was never enriched, with the metadata key absent entirely, is skipped rather than flagged, so the rule abstains on incomplete data instead of guessing. Discovery itself needs only read access: bulk inventory under roles/cloudasset.viewer, with per-bucket enrichment via storage.buckets.get. There is no automated remediation; the change is one console toggle or a single gcloud storage buckets update --public-access-prevention away, and both are auditable in the project’s activity log.