Cloud Storage buckets should prohibit anonymous and public access
Cloud Storage buckets are assessed for anonymous or public access. The control validates the bucket's IAM policy, which is recommended not to allow anonymous or public access, so that bucket contents are not readable by unauthenticated users.
Public buckets undermine confidentiality and integrity. Anyone can list or download objects; if write access exists, content can be overwritten or deleted. Using allUsers or allAuthenticatedUsers as members in an IAM member/binding causes data to be exposed outside of the organisation.
What this control checks
Cloud Storage buckets should prohibit anonymous and public access
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudstorage_bucket_public_access (prowler gcp --checks cloudstorage_bucket_public_access); PowerPipe control gcp_compliance.control.storage_bucket_not_publicly_accessible.
Scans of the Terraform code that flag the same setting before deployment: Trivy check GCP-0001.
Framework-specific interpretation
SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...).
PCI DSS v4.0: Mapped to 1.3.1 (Network access to and from the cardholder data environment is restricted.), 2.2.5 (System components are configured and managed securely.), 3.5.1.3 (Primary account number (PAN) is secured wherever it is stored.) and 10 more clauses.
ISO/IEC 27001:2022: Mapped to A.8.12 (Data Leakage Prevention).
NIST SP 800-53 Rev 5: Mapped to AC-3 (Account Management), AC-5 (Separation Of Duties), AC-6 (Least Privilege) and 1 more clause.
NIST Cybersecurity Framework v2.0: Mapped to GV.SC-05 (Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into...), ID.AM-07 (Inventories of data and corresponding metadata for designated data types are maintained.) and PR.DS-01 (The confidentiality, integrity, and availability of data-at-rest are protected.).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- 7.2.1: Access to system components and data is appropriately defined and assigned.
- 7.2.2: Access to system components and data is appropriately defined and assigned.
8 more clauses
- 7.2.5: Access to system components and data is appropriately defined and assigned.
- 7.2.6: Access to system components and data is appropriately defined and assigned.
- 7.3.1: Access to system components and data is managed via an access control system(s).
- 7.3.2: Access to system components and data is managed via an access control system(s).
- 7.3.3: Access to system components and data is managed via an access control system(s).
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- A.8.12 Data leakage prevention
- AC-5 Separation Of Duties
- AC-6: Least Privilege
- Access Enforcement (AC-3)
- Media Access (MP-2)
NIST Cybersecurity Framework v2.0
- GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties.
- ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained.
- PR.DS-01
- 5.1 Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible
- 5.1 Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible
- COS-02.01B Specific security requirements are designed, published and provided for establishing connections within the cloud service provider's network. The security requirements define for the cloud service provider's area of responsibility: - In which cases the security zones are to be...
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
- HR-01.01B The cloud service provider identifies which roles within the organisation can access cloud service customer data, cloud service derived data, cloud service provider data, account data or system components under the cloud service provider's responsibility that provide the cloud service...
3 more clauses
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 5.1 Ensure that Cloud Storage bucket is not anonymously or publicly accessible
- 5.1 Ensure that Cloud Storage bucket is not anonymously or publicly accessible
- 5.1 Ensure that Cloud Storage bucket is not anonymously or publicly accessible
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(4)(i) Information access management
- 164.312(a)(1) Access control
NIST Cybersecurity Framework v1.0
- PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- Limit access to system components and cardholder data to only those individuals whose job requires such access
Related controls
- Cloud KMS cryptokeys should prohibit anonymous and public access
- Cloud Storage should be protected by VPC Service Controls
- Compute Engine instances should not have public IP addresses
- Service accounts should not have Admin privileges
- Firewall rules should prohibit unrestricted TCP/UDP access from the internet to all ports
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_bucket_not_publicly_accessible - Powerpipe Control:
gcp_compliance.control.storage_bucket_not_publicly_accessible - Prowler Check:
cloudstorage_bucket_public_access - Trivy Check:
GCP-0001
Last reviewed: 2026-10-10