Apps with a Google Cloud Storage bucket

What this finding means

A Google Cloud Storage bucket serves the same role an S3 bucket does, but its permission model is not the same, and assuming otherwise is how buckets end up public.

We have recorded a Cloud Storage reference in 254 apps.

IAM bindings, not bucket policies

GCS access is granted through IAM, and the exposure almost always takes one form: a role bound to the member allUsers or allAuthenticatedUsers. allUsers means anyone on the internet. allAuthenticatedUsers is the more dangerous of the two, because it reads like a restriction while in fact admitting anyone holding any Google account.

Legacy ACLs exist alongside IAM and are the second source of surprises, since an object can carry an ACL its bucket's IAM policy does not describe. Uniform bucket-level access turns ACLs off and makes the IAM policy the single answer, which is why enabling it is the most useful change for most buckets.

Roles are also coarser than people expect. Storage Object Viewer on a bucket grants listing as well as reading, so a binding meant to let the public fetch one known asset hands over the index too.

How to fix it

• Enable uniform bucket-level access so IAM alone decides access.
• Search every bucket's IAM policy for allUsers and allAuthenticatedUsers, and remove both unless the bucket is deliberately a public web asset.
• Prefer signed URLs with a short expiry for user-specific objects over any public role.
• Turn on the public access prevention constraint at the organisation level so a public binding cannot be added by accident.
• Check bucket-level and object-level permissions separately if you have not yet moved to uniform access.

How we detect it, and what it cannot tell you

The bucket host and name are matched in the APK and recorded in redacted form. A reference is low severity.

A finding escalates only when an anonymous listing request confirmed the bucket answers one, with a stored record of that check. We request no objects and store no contents, so the finding establishes that the bucket responded to a caller holding no credentials — a configuration its owner chose.