Question

Security Command Center Premium raises a Security Health Analytics finding named PUBLIC_BUCKET_ACL for a Cloud Storage bucket in your production project. The bucket stores customer invoices and must never be publicly accessible. Your incident response runbook requires you to stop the exposure immediately and then prevent recurrence across all projects in the organization. Which combination of actions best satisfies both the immediate and long-term requirements?

Accepted Answer

Remove the allUsers/allAuthenticatedUsers IAM bindings from the bucket to stop the exposure, then enforce the org policy constraint constraints/iam.allowedPolicyMemberDomains (domain restricted sharing) at the organization node.

Answer

Mute the PUBLIC_BUCKET_ACL finding in Security Command Center and open a Jira ticket for the storage team to review the bucket next sprint.

Answer

Enable uniform bucket-level access on the bucket only, which automatically removes all public grants and blocks any future public access organization-wide.

Answer

Rotate the bucket's CMEK key to invalidate cached access, then apply constraints/storage.publicAccessPrevention as an organization-level deny in a hierarchical firewall policy.