GCP Bucket Exposure Calculator

Exposure index = public access prevention points + broadest IAM binding points + uniform-access points + CMEK points + VPC Service Controls points + audit log points + min(13, log2(signed URL hours) × 1.3), clamped to 0–100. Cloud Storage exposure is dominated by one control — the IAM binding — so allUsers with objectAdmin alone carries 30 of the 100 points. Public access prevention is scored separately because it is an organisation-level backstop that blocks the binding from taking effect, and audit logging is included because DATA_READ logs are off by default, which means a public bucket can be drained with no trace at all.

A single `gsutil iam ch allUsers:objectViewer` command is one keystroke from a public dataset, and without DATA_READ audit logs you will never know how many copies were taken before you noticed.

This calculator takes 9 inputs: Public access prevention, Broadest IAM binding on the bucket, Uniform bucket-level access, Encryption key, VPC Service Controls perimeter, Data access audit logs, Longest signed URL lifetime, Objects in the bucket, Data stored in the bucket. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because exposure you cannot see is worse than exposure you can. Cloud Storage data access logs are disabled by default and are not retroactive, so a bucket that was public for six months with logging off leaves you unable to answer the only question that matters during the incident: what was read, and by whom.

It removes an entire class of it. With legacy ACLs enabled, every object can carry its own grant, so a bucket that looks private at the policy level can still contain thousands of world-readable objects. Uniform access makes the bucket policy the single answer.