Cloud Storage buckets still using ACLs instead of uniform bucket-level access
What does ZopNight detect here?
Cloud Storage buckets are flagged when `uniformBucketLevelAccess` is not enabled. In that mode IAM and per-object ACLs both grant access, and a user needs only one of them to read an object, so an IAM review of the bucket can miss access granted object by object through ACLs.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1232 |
| Category | compliance |
| Severity | medium |
| Metric | none — pure configuration read |
| Threshold | uniform bucket-level access disabled |
| Source | ZopNight |
| Permissions used | storage.buckets.list · storage.buckets.get |
Where it applies
Two permission systems on one bucket
Cloud Storage has two ways to grant access. IAM works at bucket and project level, like every other Google Cloud service. ACLs are specific to Cloud Storage and can be set per object. Google’s uniform bucket-level access page explains that the two act in parallel: a user needs only one of them to grant permission.
That is the audit problem. You can review the bucket’s IAM policy, find nothing wrong, and still have objects readable by someone through an ACL added years ago. Uniform bucket-level access switches ACLs off for the whole bucket so IAM is the only source of truth. It is also required for managed folders, hierarchical namespace, IAM Conditions on the bucket and access for Workload or Workforce Identity Federation principals.
Seeing which mode a bucket is in
gcloud storage buckets describe gs://BUCKET_NAME \ --format="default(uniform_bucket_level_access)"false means ACLs are still active. Before switching, sample a few objects and look at who
their ACLs grant access to, because that access is about to disappear.
Conditions for a finding
ZopNight records, for every fully inventoried bucket, whether uniform bucket-level access is enabled, and flags the bucket when it is not. No other property is weighed: a bucket with no object ACLs at all is flagged the same as one with thousands.
What is left out
Buckets whose inventory details are incomplete are skipped. The rule does not read the ACLs themselves or the bucket’s IAM policy, so it cannot tell you whether any ACL grant is risky, only that the mechanism is still available.
Governance, with a $0 saving
No cost is involved. The benefit is a single place to review and revoke access.
Moving the bucket to IAM only
- List who the object ACLs grant access to and add equivalent IAM roles on the bucket for any access that must continue.
- Enable uniform access:
gcloud storage buckets update gs://BUCKET_NAME --uniform-bucket-level-access. - Watch for access-denied errors from applications that relied on ACLs.
- Apply the
constraints/storage.uniformBucketLevelAccessorganization policy so new buckets start in this mode.