Direct answer
Cloud Storage exposure depends on IAM, applicable ACLs and public access prevention. Review the bucket's intended audience and effective configuration before testing a controlled object.
Identify the bucket and audience
Record the project, bucket, owner, data classification and intended public or private use. Create a harmless object expressly for the assessment. Do not enumerate or download unrelated objects to demonstrate an access condition.
Reference: Google Cloud: Public access prevention.
Inspect the access model
Review bucket and inherited IAM grants, public access prevention and whether uniform bucket-level access is enabled. When uniform access is disabled, ACLs can provide an additional access path; when enabled, ACLs are disabled. Check the effective organization policy where applicable.
- Distinguish public read from public write.
- Review intentionally public content as a documented exception.
- Protect object names and signed URLs in evidence.
Compare permitted and denied reads
With explicit permission, request the test object using an authorized identity and an unauthenticated client. Check the returned object and relevant policy. A failed bucket listing does not by itself establish that a known object cannot be read.
Retest an approved change
Coordinate any public-access prevention or uniform-access change with the owner because applications may depend on existing permissions. After propagation, verify the public test and intended application read, and record excluded access paths.
Assessment limits
IAM, ACLs, inherited policy and signed URLs have different behavior. One test object does not prove the accessibility of every object or identity.
Frequently asked questions
Does uniform bucket-level access itself make a bucket private?
No. It disables ACLs, but IAM permissions and other applicable access paths must still be reviewed.
Does a denied bucket listing prove every object is private?
No. Listing and reading known objects are different operations; use a controlled object to test the relevant boundary.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.