Google Cloud Compliance ControlsGoogle Cloud Storage
Cloud Storage buckets should have soft delete enabled
Google Cloud Storage buckets are assessed for Soft Delete being enabled with a non-zero retention window. Deleted objects are temporarily preserved and can be restored until the window expires.
What this control checks
Checks each Cloud Storage bucket's soft delete setting to decide pass or fail
Framework mappings
The clauses this control is mapped to in each framework.
- AM-07.02B The decommissioning includes the complete and permanent deletion of all cloud service customer data, cloud service derived data, cloud service provider data and account data or proper destruction of the media. However, account data is only to be deleted if the data is located in the...
- PI-03.02B The deletion procedures prevent recovery by state-of-the-art forensic means.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_cloudstorage_bucket_soft_delete_enabled - Prowler Check:
cloudstorage_bucket_soft_delete_enabled
Last reviewed: 2026-10-09