Topic 5 of 10
Managing Cloud Storage
Section 3.2 of the exam guide starts with Cloud Storage: managing and securing objects in buckets, setting lifecycle management policies, and estimating storage costs. Bucket classes and locations are covered in domain D2.
Contents
Uniform or fine-grained access
Uniform (recommended)
- IAM only, applied to the bucket or to groups of objects with a common prefix.
- Enables managed folders, IAM Conditions, domain restricted sharing, and Workforce Identity Federation.
- Recommended for sensitive data.
- After enabling it you have 90 days to switch back; then it becomes permanent.
Fine-grained
- IAM plus ACLs, a legacy system designed for interoperability with Amazon S3.
- Allows per-object permissions.
- Useful to customize access to specific objects or migrate from S3.
IAM and ACLs work in parallel
Only one of the two needs to grant access. If the bucket's IAM lets only a few users read but one object has a public ACL, that object is exposed. IAM can't see ACL permissions and vice versa. The storage.uniformBucketLevelAccess organization constraint is part of the security baseline.
Cloud Storage IAM roles
| Role | What it allows |
|---|---|
Storage Object Viewerroles/storage.objectViewer | View objects and their metadata (excluding ACLs) and list the bucket's objects |
Storage Object Creatorroles/storage.objectCreator | Create objects; not view, delete, or overwrite them |
Storage Object Userroles/storage.objectUser | Create, read, update, and delete objects and multipart uploads |
Storage Object Adminroles/storage.objectAdmin | Full control of objects |
Storage Adminroles/storage.admin | Full control of objects and buckets (on a bucket, only that bucket) |
gcloud storage buckets add-iam-policy-binding gs://my-bucket \ --member=group:analysts@example.com --role=roles/storage.objectViewer
Signed URLs
They give time-limited read or write access to an object through a URL you generate. Anyone with the URL can use it for the specified time, whether or not they have a user account. They are used on top of IAM and ACLs. The maximum expiration is 7 days (604,800 seconds).
gcloud storage sign-url gs://my-bucket/report.pdf --duration=2h \ --impersonate-service-account=SA_EMAIL
Public access prevention
When enforced, no one can make the bucket's data public through IAM policies or ACLs. You enforce it on individual buckets or with the storage.publicAccessPrevention organization constraint at the project, folder, or organization level (Google recommends the highest possible level). A bucket can inherit it even if its own settings don't enforce it.
It doesn't affect creating and using signed URLs, because that access is granted through service account permissions.
Protecting data: soft delete, versioning, and retention
| Feature | What it does |
|---|---|
| Soft delete | Keeps deleted or overwritten objects and buckets so they can be restored. On by default with 7 days, adjustable from 7 to 90; 0 disables it. It can raise costs for buckets with temporary data |
| Object Versioning | When an object is replaced or deleted, keeps the previous version as noncurrent, identified by its generation number. Google recommends soft delete to protect against deletions; versioning doesn't protect against bucket deletion |
| Retention policy (Bucket Lock) | Objects can't be deleted or replaced until they meet the period (403 retentionPolicyNotMet error). It also applies to existing objects |
| Policy lock | Irreversible: you can't remove the policy or shorten the period, only extend it. The bucket can't be deleted until all objects meet the retention |
Bucket Lock, together with detailed audit logging, helps meet regulations such as FINRA, SEC, and CFTC. Object Retention Lock lets you set retention per object.
Object Lifecycle Management
A lifecycle configuration is set on the bucket and contains rules. Each rule has one action and one or more conditions; the object must meet all of them.
Delete
Deletes the object (it goes to soft delete if enabled). With versioning, deleting the live version makes it noncurrent. It doesn't act while a retention policy or hold is pending.
SetStorageClass
Changes to a colder class: Standard → Nearline, Coldline, or Archive; Nearline → Coldline or Archive; Coldline → Archive. Not used with Autoclass.
AbortIncompleteMultipartUpload
Aborts incomplete multipart uploads. Only with age, matchesPrefix, and matchesSuffix.
Conditions: age, createdBefore, customTimeBefore, daysSinceCustomTime, daysSinceNoncurrentTime, isLive, matchesStorageClass, matchesPrefix/matchesSuffix, noncurrentTimeBefore, numNewerVersions, and size.
{
"rule": [
{ "action": { "type": "SetStorageClass", "storageClass": "COLDLINE" },
"condition": { "age": 365, "matchesStorageClass": ["STANDARD"] } },
{ "action": { "type": "Delete" },
"condition": { "numNewerVersions": 3, "isLive": false } }
]
}
gcloud storage buckets update gs://my-bucket --lifecycle-file=lifecycle.json- If several rules match at once, Delete wins over SetStorageClass, and among class changes the cheapest class wins.
- Configuration changes can take up to 24 hours to take effect.
- Cloud Storage doesn't validate class transitions: an unsupported transition simply doesn't happen.
- Google recommends testing rules on development data or a small prefix.
Estimating storage costs
| Component | What it depends on |
|---|---|
| Data storage | Data stored, by the bucket's class and location |
| Data processing | Operations (Class A, Class B, and free), retrieval fees for colder classes, and inter-region replication |
| Network | Data read or moved between buckets and data egress |
| Early deletion | Deleting before Nearline, Coldline, or Archive minimum durations |
The Google Cloud pricing calculator builds estimates from your assumptions and lets you share them; Google warns they may not match the actual bill. For data stores such as BigQuery you also factor in long-term storage (tables unchanged for 90 days) and the compute model.
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| Give a customer without a Google account read access to a file for 2 hours | Signed URL | Temporary access without an account. |
| Make sure no bucket in the organization ever becomes public | storage.publicAccessPrevention constraint | Applies to a project, folder, or organization. |
| Manage permissions with IAM only, with no per-object ACLs | Uniform bucket-level access | Recommended; disables ACLs. |
| Move objects older than 365 days to Coldline | SetStorageClass lifecycle rule with age | Automatic based on conditions. |
| Keep only the 3 most recent versions of each object | Delete rule with numNewerVersions | Requires Object Versioning. |
| Immutable retention of financial records for 7 years | Locked retention policy (Bucket Lock) | Can't be reduced or removed. |
| Recover an object deleted by mistake 3 days ago | Restore it from soft delete | Kept for 7 days by default. |
| Work out what storing 50 TB in Nearline will cost | Google Cloud pricing calculator | An estimate from your assumptions. |
Common exam traps
❓ What is the maximum lifetime of a signed URL?
7 days (604,800 seconds).
❓ Can you disable uniform bucket-level access?
Only within 90 days of enabling it; after that it is permanent.
❓ Can you remove a locked retention policy?
No. Nor shorten the period; you can only extend it.
❓ Can a lifecycle rule move an object from Coldline to Nearline?
No. Only to colder classes; the transition wouldn't happen.
❓ How long does a lifecycle change take to apply?
Up to 24 hours, and the old configuration may still apply meanwhile.
❓ Does Object Versioning protect against someone deleting the bucket?
No. Only soft delete lets you recover objects from a deleted bucket.
Did you get this topic?
Test what you just learned
An application must let external customers, without Google accounts, download their PDF invoice for 24 hours after purchase. The bucket must stay private. What should it use?
Ready to test "Managing Cloud Storage"?
Original questions, each with a full explanation.
Start a mock exam