public access prevention samples & tests

storage/cloud-client/conftest.py

@@ -0,0 +1,41 @@
+#!/usr/bin/env python
+
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the 'License');
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import time
+import uuid
+
+from google.cloud import storage
+import pytest
+
+
+@pytest.fixture(scope="function")
+def bucket():
+ """Yields a bucket that is deleted after the test completes."""
+ # The new projects enforces uniform bucket level access, so
+ # we need to use the old main project for now.
+ original_value = os.environ['GOOGLE_CLOUD_PROJECT']
+ os.environ['GOOGLE_CLOUD_PROJECT'] = os.environ['MAIN_GOOGLE_CLOUD_PROJECT']
+ bucket = None
+ while bucket is None or bucket.exists():
+ bucket_name = f"uniform-bucket-level-access-{uuid.uuid4().hex}"
+ bucket = storage.Client().bucket(bucket_name)
+ bucket.create()
+ yield bucket
+ time.sleep(3)
+ bucket.delete(force=True)
+ # Set the value back.
+ os.environ['GOOGLE_CLOUD_PROJECT'] = original_value

storage/cloud-client/public_access_prevention_test.py

@@ -0,0 +1,53 @@
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import storage_get_public_access_prevention
+import storage_set_public_access_prevention_enforced
+import storage_set_public_access_prevention_unspecified
+
+
+def test_get_public_access_prevention(bucket, capsys):
+ short_name = storage_get_public_access_prevention
+ short_name.get_public_access_prevention(
+ bucket.name
+ )
+ out, _ = capsys.readouterr()
+ assert (
+ f"Public access prevention is unspecified for {bucket.name}."
+ in out
+ )
+
+
+def test_set_public_access_prevention_enforced(bucket, capsys):
+ short_name = storage_set_public_access_prevention_enforced
+ short_name.set_public_access_prevention_enforced(
+ bucket.name
+ )
+ out, _ = capsys.readouterr()
+ assert (
+ f"Public access prevention is set to enforced for {bucket.name}."
+ in out
+ )
+
+
+def test_set_public_access_prevention_unspecified(bucket, capsys):
+ short_name = storage_set_public_access_prevention_unspecified
+ short_name.set_public_access_prevention_unspecified(
+ bucket.name
+ )
+ out, _ = capsys.readouterr()
+ assert (
+ f"Public access prevention is 'unspecified' for {bucket.name}."
+ in out
+ )

storage/cloud-client/requirements.txt

@@ -1,3 +1,3 @@
 google-cloud-pubsub==2.6.0
-google-cloud-storage==1.38.0
+google-cloud-storage==1.40.0
 google-api-python-client==2.7.0

storage/cloud-client/storage_get_bucket_metadata.py

@@ -16,6 +16,7 @@
 
 
 import sys
+
 # [START storage_get_bucket_metadata]
 
 from google.cloud import storage
@@ -28,30 +29,26 @@ def bucket_metadata(bucket_name):
  storage_client = storage.Client()
  bucket = storage_client.get_bucket(bucket_name)
 
- print("ID: {}".format(bucket.id))
- print("Name: {}".format(bucket.name))
- print("Storage Class: {}".format(bucket.storage_class))
- print("Location: {}".format(bucket.location))
- print("Location Type: {}".format(bucket.location_type))
- print("Cors: {}".format(bucket.cors))
- print(
- "Default Event Based Hold: {}".format(bucket.default_event_based_hold)
- )
- print("Default KMS Key Name: {}".format(bucket.default_kms_key_name))
- print("Metageneration: {}".format(bucket.metageneration))
+ print(f"ID: {bucket.id}")
+ print(f"Name: {bucket.name}")
+ print(f"Storage Class: {bucket.storage_class}")
+ print(f"Location: {bucket.location}")
+ print(f"Location Type: {bucket.location_type}")
+ print(f"Cors: {bucket.cors}")
+ print(f"Default Event Based Hold: {bucket.default_event_based_hold}")
+ print(f"Default KMS Key Name: {bucket.default_kms_key_name}")
+ print(f"Metageneration: {bucket.metageneration}")
  print(
- "Retention Effective Time: {}".format(
- bucket.retention_policy_effective_time
- )
+ f"Public Access Prevention: {bucket.iam_configuration.public_access_prevention}"
  )
- print("Retention Period: {}".format(bucket.retention_period))
- print("Retention Policy Locked: {}".format(bucket.retention_policy_locked))
- print("Requester Pays: {}".format(bucket.requester_pays))
- print("Self Link: {}".format(bucket.self_link))
- print("Time Created: {}".format(bucket.time_created))
- print("Versioning Enabled: {}".format(bucket.versioning_enabled))
- print("Labels:")
- print(bucket.labels)
+ print(f"Retention Effective Time: {bucket.retention_policy_effective_time}")
+ print(f"Retention Period: {bucket.retention_period}")
+ print(f"Retention Policy Locked: {bucket.retention_policy_locked}")
+ print(f"Requester Pays: {bucket.requester_pays}")
+ print(f"Self Link: {bucket.self_link}")
+ print(f"Time Created: {bucket.time_created}")
+ print(f"Versioning Enabled: {bucket.versioning_enabled}")
+ print(f"Labels: {bucket.labels}")
 
 
 # [END storage_get_bucket_metadata]

storage/cloud-client/storage_get_public_access_prevention.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python
+
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the 'License');
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import sys
+
+# [START storage_get_public_access_prevention]
+from google.cloud import storage
+
+
+def get_public_access_prevention(bucket_name):
+ """Gets the public access prevention setting (either 'unspecified' or 'enforced') for a bucket."""
+ # The ID of your GCS bucket
+ # bucket_name = "my-bucket"
+
+ storage_client = storage.Client()
+ bucket = storage_client.get_bucket(bucket_name)
+ iam_configuration = bucket.iam_configuration
+
+ print(
+ f"Public access prevention is {iam_configuration.public_access_prevention} for {bucket.name}."
+ )
+
+
+# [END storage_get_public_access_prevention]
+
+if __name__ == "__main__":
+ get_public_access_prevention(bucket_name=sys.argv[1])

storage/cloud-client/storage_set_public_access_prevention_enforced.py

@@ -0,0 +1,43 @@
+#!/usr/bin/env python
+
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the 'License');
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import sys
+
+# [START storage_set_public_access_prevention_enforced]
+from google.cloud import storage
+from google.cloud.storage.constants import PUBLIC_ACCESS_PREVENTION_ENFORCED
+
+
+def set_public_access_prevention_enforced(bucket_name):
+ """Enforce public access prevention for a bucket."""
+ # The ID of your GCS bucket
+ # bucket_name = "my-bucket"
+
+ storage_client = storage.Client()
+ bucket = storage_client.get_bucket(bucket_name)
+
+ bucket.iam_configuration.public_access_prevention = (
+ PUBLIC_ACCESS_PREVENTION_ENFORCED
+ )
+ bucket.patch()
+
+ print(f"Public access prevention is set to enforced for {bucket.name}.")
+
+
+# [END storage_set_public_access_prevention_enforced]
+
+if __name__ == "__main__":
+ set_public_access_prevention_enforced(bucket_name=sys.argv[1])

storage/cloud-client/storage_set_public_access_prevention_unspecified.py

@@ -0,0 +1,43 @@
+#!/usr/bin/env python
+
+# Copyright 2021 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the 'License');
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import sys
+
+# [START storage_set_public_access_prevention_unspecified]
+from google.cloud import storage
+from google.cloud.storage.constants import PUBLIC_ACCESS_PREVENTION_UNSPECIFIED
+
+
+def set_public_access_prevention_unspecified(bucket_name):
+ """Sets the public access prevention status to unspecified, so that the bucket inherits its setting from its parent project."""
+ # The ID of your GCS bucket
+ # bucket_name = "my-bucket"
+
+ storage_client = storage.Client()
+ bucket = storage_client.get_bucket(bucket_name)
+
+ bucket.iam_configuration.public_access_prevention = (
+ PUBLIC_ACCESS_PREVENTION_UNSPECIFIED
+ )
+ bucket.patch()
+
+ print(f"Public access prevention is 'unspecified' for {bucket.name}.")
+
+
+# [END storage_set_public_access_prevention_unspecified]
+
+if __name__ == "__main__":
+ set_public_access_prevention_unspecified(bucket_name=sys.argv[1])

storage/cloud-client/uniform_bucket_level_access_test.py

@@ -12,37 +12,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import os
-import time
-import uuid
-
-from google.cloud import storage
-import pytest
-
 import storage_disable_uniform_bucket_level_access
 import storage_enable_uniform_bucket_level_access
 import storage_get_uniform_bucket_level_access
 
 
-@pytest.fixture()
-def bucket():
- """Yields a bucket that is deleted after the test completes."""
- # The new projects enforces uniform bucket level access, so
- # we need to use the old main project for now.
- original_value = os.environ['GOOGLE_CLOUD_PROJECT']
- os.environ['GOOGLE_CLOUD_PROJECT'] = os.environ['MAIN_GOOGLE_CLOUD_PROJECT']
- bucket = None
- while bucket is None or bucket.exists():
- bucket_name = "uniform-bucket-level-access-{}".format(uuid.uuid4().hex)
- bucket = storage.Client().bucket(bucket_name)
- bucket.create()
- yield bucket
- time.sleep(3)
- bucket.delete(force=True)
- # Set the value back.
- os.environ['GOOGLE_CLOUD_PROJECT'] = original_value
-
-
 def test_get_uniform_bucket_level_access(bucket, capsys):
  storage_get_uniform_bucket_level_access.get_uniform_bucket_level_access(
  bucket.name