Cloud Storage Bucket Security

Cloud Storage is Google Cloud's object storage service. Security is implemented at multiple layers: network-level (VPC Service Controls), access control (IAM, ACLs, signed URLs), encryption (CSEK, CMEK, default), and data governance (retention policies, Object Lifecycle Management). The ACE exam focuses on access control and encryption choices.

Cloud Storage supports two access control models: Uniform and Fine-grained (ACLs).

- Uniform bucket-level access: All access is governed by IAM policies at the bucket level. This is the recommended model because it simplifies management and avoids conflicts. When enabled, ACLs are disabled and IAM policies control access to all objects in the bucket. Default: disabled for new buckets (but Google recommends enabling it). To enable:

gsutil uniformbucketlevelaccess set on gs://my-bucket

IAM roles are the primary way to grant permissions. Predefined roles include: - Storage Object Viewer (roles/storage.objectViewer): Read objects (no listing). - Storage Object Creator (roles/storage.objectCreator): Create objects but not read. - Storage Object Admin (roles/storage.objectAdmin): Full control over objects. - Storage Admin (roles/storage.admin): Full control over buckets and objects. - Storage Legacy Bucket Reader (roles/storage.legacyBucketReader): List bucket contents. - Storage Legacy Bucket Writer (roles/storage.legacyBucketWriter): Write objects. - Storage Legacy Object Reader (roles/storage.legacyObjectReader): Read objects.

Important: The storage.objectViewer role does NOT allow listing objects in a bucket. To list, you need storage.legacyBucketReader or storage.objects.list permission. This is a common exam trap.

Signed URLs allow time-limited access to a specific object without requiring authentication. A signed URL is generated using a service account key or a user's private key. It includes an expiration time (max 7 days for service accounts, 12 hours for user accounts). Signed URLs are used for:

A signed policy document is used for form-based uploads, allowing a browser to upload directly to Cloud Storage. The policy document specifies conditions (e.g., bucket, object prefix, content type, size range).

Cloud Storage encrypts data at rest by default using Google-managed keys. You can also use: - Customer-managed encryption keys (CMEK): You manage the key via Cloud KMS. You can rotate and disable keys. Use CMEK for compliance requirements. - Customer-supplied encryption keys (CSEK): You provide your own AES-256 key for each API call. Google does not store your key; you must manage it. CSEK is for maximum control but adds operational burden.

Key points for the exam:

Retention policies prevent object deletion or modification for a specified duration. Once set, objects cannot be deleted or overwritten until the retention period expires. Bucket Lock permanently locks a retention policy, making it immutable. This is used for compliance (e.g., SEC Rule 17a-4). - Retention policy is set at bucket level. - Default: no retention. - To lock: gsutil retention lock gs://my-bucket — this is irreversible. - Objects with a retention policy cannot be deleted or replaced. Overwriting an object creates a new generation; the old generation still exists until the retention period ends.

Lifecycle rules automate actions on objects based on conditions (age, creation date, storage class, etc.). Common actions: delete, set storage class (e.g., to Nearline, Coldline, Archive).

Example: Delete objects older than 365 days:

{
  "lifecycle": {
    "rule": [
      {
        "action": {"type": "Delete"},
        "condition": {"age": 365}
      }
    ]
  }
}

Lifecycle rules are applied asynchronously (usually within 24 hours). They cannot delete objects under retention policy.

By default, new buckets are not public. However, you can explicitly make a bucket public by granting allUsers or allAuthenticatedUsers access. The exam tests that you must be careful with public access. Use gsutil iam ch allUsers:objectViewer gs://my-bucket to make objects publicly readable.

To prevent public access, enable Public Access Prevention at the organization or project level via Organization Policies. This blocks any attempt to make a bucket public.

VPC Service Controls allow you to restrict access to Cloud Storage from outside a VPC. This is an advanced security feature that the ACE exam may touch on lightly. It helps prevent data exfiltration.

Cloud Audit Logs record admin activities (e.g., bucket creation, IAM changes) and data access (e.g., object reads). To enable data access logs, you must explicitly enable them in the project. They are not enabled by default due to volume. The exam may ask how to audit access.

A healthcare company stores patient records in Cloud Storage. They must comply with HIPAA, which requires encryption at rest and access controls. They use CMEK to manage keys via Cloud KMS, enabling key rotation and audit. They enable uniform bucket-level access and grant only specific service accounts the objectViewer role. They also enable VPC Service Controls to prevent data exfiltration. They set a retention policy of 7 years and lock it to comply with medical record retention laws. They use Object Lifecycle Management to delete objects older than 7 years after retention expires. Common misconfiguration: forgetting to lock the retention policy, allowing accidental deletion.

A media company allows users to upload and share videos. They use signed URLs for uploads to avoid giving users IAM permissions. They also use signed URLs for temporary viewing (e.g., 24 hours). They store videos in Nearline storage to reduce costs. They use Cloud CDN to serve content with signed URLs for additional security. They enable object versioning to recover from accidental overwrites. Performance consideration: signed URL generation overhead is negligible. Common issue: signed URL expiration too long, leading to unauthorized access.

A bank archives transaction records in Cloud Storage for regulatory compliance. They use Archive storage class for cost savings. They set a retention policy of 10 years and lock it using Bucket Lock. They enable uniform bucket-level access and grant read-only access to auditors via IAM. They use CSEK for maximum control over encryption keys. They enable Cloud Audit Logs for data access to monitor who reads records. They use lifecycle rules to delete objects after 10 years. Common pitfall: not enabling data access logs, making audits impossible.