Cloud Storage buckets should have lifecycle management configured
Cloud Storage buckets use Object Lifecycle Management with at least one valid rule (supported `action` and non-empty `condition`). The rule automatically transitions storage class or deletes objects.
Without lifecycle rules, data and object versions persist indefinitely, expanding the attack surface and hindering mandated erasure. Stale data amplifies exfiltration impact (confidentiality) and complicates integrity controls, while also driving avoidable cost and retention noncompliance.
What this control checks
Bucket has Object Lifecycle Management with at least one valid rule (supported action, non-empty.
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudstorage_bucket_lifecycle_management_enabled (prowler gcp --checks cloudstorage_bucket_lifecycle_management_enabled).
Framework-specific interpretation
BSI C5:2025: Mapped to OPS-32.02B (The guidelines and instructions should describe measures along the life cycle of containers and address at least the...).
Framework mappings
The clauses this control is mapped to in each framework.
- OPS-32.02B The guidelines and instructions should describe measures along the life cycle of containers and address at least the following aspects: - Containers are inventoried according to a documented process (cf. AM-02, AM-03, AM-09);- The need for malware protection is assessed and, if...
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_cloudstorage_bucket_lifecycle_management_enabled - Prowler Check:
cloudstorage_bucket_lifecycle_management_enabled
Last reviewed: 2026-10-09