Skip to content
ENExplore Calculators

GCP Bucket Exposure Calculator

Score a Cloud Storage bucket's exposure from public access prevention, allUsers IAM bindings, uniform access, signed URLs, CMEK and audit logging.

About GCP Bucket Exposure Calculator

Cloud Storage exposure is dominated by one control — the IAM binding — so allUsers with objectAdmin alone carries 30 of the 100 points. Public access prevention is scored separately because it is an organisation-level backstop that blocks the binding from taking effect, and audit logging is included because DATA_READ logs are off by default, which means a public bucket can be drained with no trace at all. A single `gsutil iam ch allUsers:objectViewer` command is one keystroke from a public dataset, and without DATA_READ audit logs you will never know how many copies were taken before you noticed.

Formulas

GCP Bucket Exposure

Exposure index = public access prevention points + broadest IAM binding points + uniform-access points + CMEK points + VPC Service Controls points + audit log points + min(13, log2(signed URL hours) × 1.3), clamped to 0–100.

iamBinding
0–30 points for the broadest member on the bucket
publicAccessPrevention
20 points while the organisation policy is only inherited
vpcSc
10 points when no service perimeter contains the bucket

Exposed volume

Objects in the exposed path = object count × exposure index ÷ 100 — a linear read of how much of the bucket the scored configuration puts within reach.

objectCount
Objects currently stored in the bucket
exposureIndex
0–100 weighted exposure index

Worked example

With the default values below, GCP Bucket Exposure Calculator returns Exposure Index of 67.3. Change any input above and every figure here is recalculated in your browser.

Inputs used

Public access preventionone of Enforced by organisation policy — 0, Inherited, not enforced — 20
Inherited, not enforced — 20
Broadest IAM binding on the bucketone of No allUsers or allAuthenticatedUsers binding — 0, allAuthenticatedUsers objectViewer — 15, allUsers objectViewer — 25, allUsers objectAdmin — 30
allAuthenticatedUsers objectViewer — 15
Uniform bucket-level accessone of Enabled, legacy ACLs removed — 0, Disabled, legacy ACLs in use — 12
Enabled, legacy ACLs removed — 0
Encryption keyone of Customer-managed key in Cloud KMS — 0, Google-managed key — 4
Google-managed key — 4
VPC Service Controls perimeterone of Bucket sits inside a perimeter — 0, No perimeter — 10
No perimeter — 10
Data access audit logsone of ADMIN_READ and DATA_READ enabled — 0, ADMIN_READ only — 6, Data access logging disabled — 10
ADMIN_READ only — 6
Longest signed URL lifetimeaccepts 0–168,000 hours
720 hours
Objects in the bucketaccepts 0–100,000,000,000 objects
840,000 objects
Data stored in the bucketaccepts 0–100,000,000 GB
2,600 GB

Results

Exposure Index
67.3 / 100
Exposure Level
High
Objects in the Exposed Path
565,651 objects
Data in the Exposed Path
1,750.8 GB
Signed URL Risk Points
12.3 points
Dominant Exposure Path
Public access prevention is not enforced by organisation policy
Recommended Remediation
Remove the allUsers and allAuthenticatedUsers bindings, then enforce public access prevention at the organisation node

Step by step

  1. 1Values used
  2. 2GCP Bucket Exposure
  3. 3Exposed volume
  4. 4Exposure Index= 67.3 / 100
  5. 5Exposure Level= High
  6. 6Objects in the Exposed Path= 565,651 objects
  7. 7Data in the Exposed Path= 1,750.8 GB
  8. 8Signed URL Risk Points= 12.3 points
  9. 9Dominant Exposure Path= Public access prevention is not enforced by organisation policy

Assumptions and limits

  • The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is GCP Bucket Exposure calculated?

Exposure index = public access prevention points + broadest IAM binding points + uniform-access points + CMEK points + VPC Service Controls points + audit log points + min(13, log2(signed URL hours) × 1.3), clamped to 0–100. Cloud Storage exposure is dominated by one control — the IAM binding — so allUsers with objectAdmin alone carries 30 of the 100 points. Public access prevention is scored separately because it is an organisation-level backstop that blocks the binding from taking effect, and audit logging is included because DATA_READ logs are off by default, which means a public bucket can be drained with no trace at all.

Why does GCP Bucket Exposure matter?

A single `gsutil iam ch allUsers:objectViewer` command is one keystroke from a public dataset, and without DATA_READ audit logs you will never know how many copies were taken before you noticed.

What values do I need to enter?

This calculator takes 9 inputs: Public access prevention, Broadest IAM binding on the bucket, Uniform bucket-level access, Encryption key, VPC Service Controls perimeter, Data access audit logs, Longest signed URL lifetime, Objects in the bucket, Data stored in the bucket. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why score audit logging in an exposure calculator?

Because exposure you cannot see is worse than exposure you can. Cloud Storage data access logs are disabled by default and are not retroactive, so a bucket that was public for six months with logging off leaves you unable to answer the only question that matters during the incident: what was read, and by whom.

Does uniform bucket-level access reduce exposure on its own?

It removes an entire class of it. With legacy ACLs enabled, every object can carry its own grant, so a bucket that looks private at the policy level can still contain thousands of world-readable objects. Uniform access makes the bucket policy the single answer.

Related Calculators

GCP Bucket Exposure Calculator | Calcrivo