Google Cloud Compliance ControlsGoogle Cloud Storage
Cloud Storage buckets used for exporting logs should prohibit anonymous and public access
It is recommended that IAM policy on Cloud Storage bucket used for exporting logs does not allows anonymous or public access. Buckets are assessed for anonymous or public access via broad principals like `allUsers` or `allAuthenticatedUsers`.
What this control checks
Log export bucket IAM policy must not grant allUsers or allAuthenticatedUsers access
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
15 more clauses
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.2.6: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
- 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- 10.3.3: Audit log files, including those for externalfacing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify
- 10.3.4: File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- A.8.12 Data leakage prevention
NIST Cybersecurity Framework v2.0
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- 5.1 Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible
- 5.1 Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible
- COS-02.01B Specific security requirements are designed, published and provided for establishing connections within the cloud service provider's network. The security requirements define for the cloud service provider's area of responsibility: - In which cases the security zones are to be...
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
- HR-01.01B The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service...
3 more clauses
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 5.1 Ensure that Cloud Storage bucket is not anonymously or publicly accessible
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(4)(i) Information access management
- 164.312(a)(1) Access control
- Interview system administrators and examine system configurations and permissions to verify that audit trails are secured so that they cannot be altered
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_bucket_log_not_publicly_accessible - Powerpipe Controls:
gcp_compliance.control.storage_bucket_log_not_publicly_accessible,gcp_compliance.control.storage_bucket_not_publicly_accessible - Prowler Check:
cloudstorage_bucket_public_access - Trivy Check:
GCP-0001
Last reviewed: 2026-10-10