Google Cloud Storage
Google Cloud Storage exposures usually come from an IAM binding granting the `allUsers` or `allAuthenticatedUsers` principal `Storage Object Viewer` or `Storage Legacy Bucket Reader`. The bucket then accepts unauthenticated `GET ?list` requests.
Google Cloud Storage exposure data
Aggregate figures only. See the full open-buckets data across all providers.
Common misconfiguration class
GCS does not enforce Public-Access-Prevention by default. Buckets created before 2021 frequently kept legacy ACLs. The newer Uniform-Bucket-Level-Access mode removes ACL drift but isn't retroactive, so admins have to opt in per bucket.
Real-world impact
A public list on the GCS XML API (`GET storage.googleapis.com/<bucket>`) returns an XML manifest of every object. Even when the bucket is meant to serve a single static asset, the manifest leaks naming conventions, internal paths, and sometimes secrets in filenames.
Remediation
- Switch the bucket to Uniform-Bucket-Level-Access, then remove the `allUsers` IAM binding.
- Enable Public-Access-Prevention at the org or project level so re-creation of the binding fails.
- Use signed URLs for time-limited public sharing instead of permanent public-read grants.
URL patterns
Google Cloud Storage buckets typically resolve under hostnames like:
storage.googleapis.com/example-bucket/example-bucket.storage.googleapis.com
Check a specific Google Cloud Storage URL
Paste any Google Cloud Storage URL into our free Open Viewer to inspect its contents directly in your browser, no signup needed.
Open the ViewerOwn a listed Google Cloud Storage bucket?
If a bucket you operate appears in our index and you have remediated the misconfiguration, submit a takedown request and we'll remove it from public listings within 4 hours.
Submit takedown request