Score a Cloud Storage bucket's exposure from public access prevention, allUsers IAM bindings, uniform access, signed URLs, CMEK and audit logging.
Cloud Storage exposure is dominated by one control — the IAM binding — so allUsers with objectAdmin alone carries 30 of the 100 points. Public access prevention is scored separately because it is an organisation-level backstop that blocks the binding from taking effect, and audit logging is included because DATA_READ logs are off by default, which means a public bucket can be drained with no trace at all. A single `gsutil iam ch allUsers:objectViewer` command is one keystroke from a public dataset, and without DATA_READ audit logs you will never know how many copies were taken before you noticed.
GCP Bucket Exposure
Exposure index = public access prevention points + broadest IAM binding points + uniform-access points + CMEK points + VPC Service Controls points + audit log points + min(13, log2(signed URL hours) × 1.3), clamped to 0–100.
Exposed volume
Objects in the exposed path = object count × exposure index ÷ 100 — a linear read of how much of the bucket the scored configuration puts within reach.
Exposure index = public access prevention points + broadest IAM binding points + uniform-access points + CMEK points + VPC Service Controls points + audit log points + min(13, log2(signed URL hours) × 1.3), clamped to 0–100. Cloud Storage exposure is dominated by one control — the IAM binding — so allUsers with objectAdmin alone carries 30 of the 100 points. Public access prevention is scored separately because it is an organisation-level backstop that blocks the binding from taking effect, and audit logging is included because DATA_READ logs are off by default, which means a public bucket can be drained with no trace at all.
A single `gsutil iam ch allUsers:objectViewer` command is one keystroke from a public dataset, and without DATA_READ audit logs you will never know how many copies were taken before you noticed.
This calculator takes 9 inputs: Public access prevention, Broadest IAM binding on the bucket, Uniform bucket-level access, Encryption key, VPC Service Controls perimeter, Data access audit logs, Longest signed URL lifetime, Objects in the bucket, Data stored in the bucket. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because exposure you cannot see is worse than exposure you can. Cloud Storage data access logs are disabled by default and are not retroactive, so a bucket that was public for six months with logging off leaves you unable to answer the only question that matters during the incident: what was read, and by whom.
It removes an entire class of it. With legacy ACLs enabled, every object can carry its own grant, so a bucket that looks private at the policy level can still contain thousands of world-readable objects. Uniform access makes the bucket policy the single answer.