Top / Google Cloud Platform / Google Cloud Storage / Default Object ACL

Google Cloud Storage Default Object ACL

This page shows how to write Terraform for Cloud Storage Default Object ACL and write them securely.

terraform-logo

Review your .tf file for Google best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).

google_storage_default_object_acl (Terraform)

The Default Object ACL in Cloud Storage can be configured in Terraform with the resource name google_storage_default_object_acl. The following sections describe 5 examples of how to use the resource and its parameters.

Example Usage from GitHub

storage_default_object_acl.tf#L2
resource "google_storage_default_object_acl" "tfer--trip-002D-planner-002D-gcs" {
  bucket      = "trip-planner-gcs"
  role_entity = ["READER:project-viewers-1078932510854", "OWNER:project-editors-1078932510854", "OWNER:project-owners-1078932510854"]
}

resource "google_storage_default_object_acl" "tfer--trip-002D-planner-002D-storage" {
main.tf#L7
resource "google_storage_default_object_acl" "this" {
  bucket      = var.bucket
  role_entity = var.role_entity
}
main.tf#L25
resource "google_storage_default_object_acl" "this" {
  bucket      = google_storage_bucket.this.name
  role_entity = var.role_entity
}
google.tf#L26
resource "google_storage_default_object_acl" "default_object_acl" {
  bucket      = google_storage_bucket.bucket.name
  role_entity = ["READER:allUsers"]
}

resource "google_compute_global_forwarding_rule" "forwarding_rule" {
storage_default_object_acl.tf#L2
resource "google_storage_default_object_acl" "testing" {
  bucket      = "testing"
  role_entity = ["OWNER:project-editors-307194479120", "OWNER:project-owners-307194479120", "READER:project-viewers-307194479120"]
}

Review your Terraform file for Google best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).

Parameters

>> from Terraform Registry

Explanation in Terraform Registry

Authoritatively manages the default object ACLs for a Google Cloud Storage bucket without managing the bucket itself. -> Note that for each object, its creator will have the "OWNER" role in addition to the default ACL that has been defined. For more information see the official documentation and API. -> Want fine-grained control over default object ACLs? Use google_storage_default_object_access_control to control individual role entity pairs.

>> from Terraform Registry

Tips: Best Practices for The Other Google Cloud Storage Resources

In addition to the google_storage_bucket, Google Cloud Storage has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

risk-label

google_storage_bucket

Ensure uniform bucket-level access of your GCS bucket is enabled

It is better to enable uniform bucket-level access of the GCS bucket. Uniform bucket-level access unifies and simplifies how you grant access to resources in the bucket.

Review your Google Cloud Storage settings

In addition to the above, there are other security points you should be aware of making sure that your .tf files are protected in Shisho Cloud.

The Other Related Google Cloud Storage Resources

Frequently asked questions

What is Google Cloud Storage Default Object ACL?

Google Cloud Storage Default Object ACL is a resource for Cloud Storage of Google Cloud Platform. Settings can be wrote in Terraform.

Where can I find the example code for the Google Cloud Storage Default Object ACL?

For Terraform, the tsm2k/terraform_deploy, niveklabs/google and jdpleiness/terraform-google-storage-static-website source code examples are useful. See the Terraform Example section for further details.

security-icon

Automate config file reviews on your commits

Fix issues in your infrastructure as code with auto-generated patches.

Table of Contents