> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/gcp/gcp-offensive-security/gcp-enumeration/cloud-storage.md).

# Cloud Storage

## Object Versioning

* When versioning is enabled on a bucket, GCS retains every generation of an object on overwrite or delete rather than destroying it. With `storage.objects.list`, an attacker can enumerate all generations and fetch any non-current version directly — recovering secrets, keys, or files the owner believed were gone.

{% code overflow="wrap" %}

```shell
gcloud storage ls --all-versions gs://<BUCKET_NAME>/

gcloud storage cp gs://<BUCKET_NAME>/<OBJECT>#<GENERATION_NUMBER> -
```

{% endcode %}

***

## Identifying Public Buckets

* GCP bucket names are globally unique, and their contents can be publicly exposed depending on how IAM is configured.&#x20;
* Tools like [cloud\_enum](https://github.com/initstring/cloud_enum) can automate bucket discovery and access checks.
* For a bucket or its objects to be readable, the principal must have `storage.objects.get` (e.g., via `roles/storage.objectViewer`).&#x20;
* The big misconfiguration is when this is granted to:
  * `allUsers` — anyone on the internet, no authentication required
  * `allAuthenticatedUsers` — anyone with any Google account

{% code overflow="wrap" %}

```shellscript
uv run cloud_enum.py -k test9273492374 --disable-aws --disable-azure 2>&1

[+] Checking for Google buckets
  OPEN GOOGLE BUCKET: http://storage.googleapis.com/test9273492374
      FILES:
      ->http://storage.googleapis.com/test9273492374/test9273492374
      ->http://storage.googleapis.com/test9273492374/test/
```

{% endcode %}