Cloud Storage buckets should have uniform bucket-level access enabled
Uniform bucket-level access should be enabled on Cloud Storage buckets. When enabled, Access Control Lists (ACLs) are disabled, and only bucket-level Identity and Access Management (IAM) permissions grant access to that bucket and the objects it contains.
When you enable uniform bucket-level access on a bucket, Access Control Lists (ACLs) are disabled, and only bucket-level Identity and Access Management (IAM) permissions grant access to that bucket and the objects it contains. You revoke all access granted by object ACLs and the ability to administrate permissions using bucket ACLs.
What this control checks
Cloud Storage buckets should have uniform bucket-level access enabled
Common pitfalls
Unset uniform_bucket_level_access fails the check
KICS flags a google_storage_bucket with uniform_bucket_level_access set to false. The same query also flags a google_storage_bucket where uniform_bucket_level_access is not set.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe controls gcp_compliance.control.require_bucket_policy_only and gcp_compliance.control.storage_bucket_uniform_access_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_29; KICS query "Google Storage Bucket Level Access Disabled" (bb0db090-5509-4853-a827-75ced0b3caa0); Trivy check GCP-0002.
Framework-specific interpretation
CIS GCP Benchmark v3.0.0: Mapped to 5.2 (Ensure That Cloud Storage Buckets Have Uniform BucketLevel Access Enabled).
CIS GCP Benchmark v4.0.0: Mapped to 5.2 (Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled).
CIS GCP Benchmark v1.2.0: Mapped to 5.2 (Ensure that Cloud Storage buckets have uniform bucket-level access enabled).
CIS GCP Benchmark v1.3.0: Mapped to 5.2 (Ensure that Cloud Storage buckets have uniform bucket-level access enabled).
CIS GCP Benchmark v2.0.0: Mapped to 5.2 (Ensure that Cloud Storage buckets have uniform bucket-level access enabled).
Framework mappings
The clauses this control is mapped to in each framework.
- 5.2 Ensure That Cloud Storage Buckets Have Uniform BucketLevel Access Enabled
- 5.2 Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled
- 5.2 Ensure that Cloud Storage buckets have uniform bucket-level access enabled
- 5.2 Ensure that Cloud Storage buckets have uniform bucket-level access enabled
- 5.2 Ensure that Cloud Storage buckets have uniform bucket-level access enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_bucket_uniform_access_enabled - Checkov Check:
CKV_GCP_29 - Powerpipe Controls:
gcp_compliance.control.require_bucket_policy_only,gcp_compliance.control.storage_bucket_uniform_access_enabled - KICS Query:
bb0db090-5509-4853-a827-75ced0b3caa0 - Trivy Check:
GCP-0002
Last reviewed: 2026-10-10