Console

1. In the Google Cloud console, go to the Cloud StorageBuckets page.
   

   Go to Buckets

2. In the list of buckets, click the name of the bucket that you want tomake public.

3. Select thePermissions tab near the top of the page.

4. In thePermissions section, click theperson_addGrant access button.

   TheGrant access dialog appears.

5. In theNew principals field, enterallUsers.

6. In theSelect a role drop down, enterStorage Object Viewer inthe filter box and select theStorage Object Viewer from thefiltered results.

7. ClickSave.

8. ClickAllow public access.

Once public access has been granted, aCopy URL button appears for eachobject in thepublic access column. You can click this button to get thepublic URL for the object. The public URL is different from the linkyou get from directly right-clicking an object. Both links provideaccess to an object, but the public URL works without the user having tosign into a user account. SeeRequest endpoints for more information.

To learn how to get detailed error information about failed Cloud Storage operations in the Google Cloud console, seeTroubleshooting.

Command line

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. In your development environment, run thebuckets add-iam-policy-binding command:

   gcloud storage buckets add-iam-policy-binding gs://BUCKET_NAME --member=allUsers --role=roles/storage.objectViewer

   WhereBUCKET_NAME is the name of the bucketwhose objects you want to make public. For example,my-bucket.

Client libraries

namespacegcs=::google::cloud::storage;using::google::cloud::StatusOr;[](gcs::Clientclient,std::stringconst&bucket_name){autocurrent_policy=client.GetNativeBucketIamPolicy(bucket_name,gcs::RequestedPolicyVersion(3));if(!current_policy)throwstd::move(current_policy).status();current_policy->set_version(3);current_policy->bindings().emplace_back(gcs::NativeIamBinding("roles/storage.objectViewer",{"allUsers"}));autoupdated=client.SetNativeBucketIamPolicy(bucket_name,*current_policy);if(!updated)throwstd::move(updated).status();std::cout <<"Policy successfully updated: " <<*updated <<"\n";}

usingGoogle.Apis.Storage.v1.Data;usingGoogle.Cloud.Storage.V1;usingSystem;usingSystem.Collections.Generic;publicclassMakeBucketPublicSample{publicvoidMakeBucketPublic(stringbucketName="your-unique-bucket-name"){varstorage=StorageClient.Create();Policypolicy=storage.GetBucketIamPolicy(bucketName);policy.Bindings.Add(newPolicy.BindingsData{Role="roles/storage.objectViewer",Members=newList<string>{"allUsers"}});storage.SetBucketIamPolicy(bucketName,policy);Console.WriteLine(bucketName+" is now public ");}}

import("context""fmt""io""cloud.google.com/go/iam""cloud.google.com/go/iam/apiv1/iampb""cloud.google.com/go/storage")// setBucketPublicIAM makes all objects in a bucket publicly readable.funcsetBucketPublicIAM(wio.Writer,bucketNamestring)error{// bucketName := "bucket-name"ctx:=context.Background()client,err:=storage.NewClient(ctx)iferr!=nil{returnfmt.Errorf("storage.NewClient: %w",err)}deferclient.Close()policy,err:=client.Bucket(bucketName).IAM().V3().Policy(ctx)iferr!=nil{returnfmt.Errorf("Bucket(%q).IAM().V3().Policy: %w",bucketName,err)}role:="roles/storage.objectViewer"policy.Bindings=append(policy.Bindings,&iampb.Binding{Role:role,Members:[]string{iam.AllUsers},})iferr:=client.Bucket(bucketName).IAM().V3().SetPolicy(ctx,policy);err!=nil{returnfmt.Errorf("Bucket(%q).IAM().SetPolicy: %w",bucketName,err)}fmt.Fprintf(w,"Bucket %v is now publicly readable\n",bucketName)returnnil}

importcom.google.cloud.Identity;importcom.google.cloud.Policy;importcom.google.cloud.storage.Storage;importcom.google.cloud.storage.StorageOptions;importcom.google.cloud.storage.StorageRoles;publicclassMakeBucketPublic{publicstaticvoidmakeBucketPublic(StringprojectId,StringbucketName){// The ID of your GCP project// String projectId = "your-project-id";// The ID of your GCS bucket// String bucketName = "your-unique-bucket-name";Storagestorage=StorageOptions.newBuilder().setProjectId(projectId).build().getService();PolicyoriginalPolicy=storage.getIamPolicy(bucketName);storage.setIamPolicy(bucketName,originalPolicy.toBuilder().addIdentity(StorageRoles.objectViewer(),Identity.allUsers())// All users can view.build());System.out.println("Bucket "+bucketName+" is now publicly readable");}}

/** * TODO(developer): Uncomment the following lines before running the sample. */// The ID of your GCS bucket// const bucketName = 'your-unique-bucket-name';// Imports the Google Cloud client libraryconst{Storage}=require('@google-cloud/storage');// Creates a clientconststorage=newStorage();asyncfunctionmakeBucketPublic(){awaitstorage.bucket(bucketName).makePublic();console.log(`Bucket${bucketName} is now publicly readable`);}makeBucketPublic().catch(console.error);

use Google\Cloud\Storage\StorageClient;/** * Update the specified bucket's IAM configuration to make it publicly accessible. * * @param string $bucketName The name of your Cloud Storage bucket. *        (e.g. 'my-bucket') */function set_bucket_public_iam(string $bucketName): void{    $storage = new StorageClient();    $bucket = $storage->bucket($bucketName);    $policy = $bucket->iam()->policy(['requestedPolicyVersion' => 3]);    $policy['version'] = 3;    $role = 'roles/storage.objectViewer';    $members = ['allUsers'];    $policy['bindings'][] = [        'role' => $role,        'members' => $members    ];    $bucket->iam()->setPolicy($policy);    printf('Bucket %s is now public', $bucketName);}

fromtypingimportListfromgoogle.cloudimportstoragedefset_bucket_public_iam(bucket_name:str="your-bucket-name",members:List[str]=["allUsers"],):"""Set a public IAM Policy to bucket"""# bucket_name = "your-bucket-name"storage_client=storage.Client()bucket=storage_client.bucket(bucket_name)policy=bucket.get_iam_policy(requested_policy_version=3)policy.bindings.append({"role":"roles/storage.objectViewer","members":members})bucket.set_iam_policy(policy)print(f"Bucket{bucket.name} is now publicly readable")

defset_bucket_public_iambucket_name:# The ID of your GCS bucket# bucket_name = "your-unique-bucket-name"require"google/cloud/storage"storage=Google::Cloud::Storage.newbucket=storage.bucketbucket_namebucket.policydo|p|p.add"roles/storage.objectViewer","allUsers"endputs"Bucket#{bucket_name} is now publicly readable"end

Terraform

You can use aTerraform resource to make all objects in abucket public.

# Make bucket publicresource "google_storage_bucket_iam_member" "member" {  provider = google  bucket   = google_storage_bucket.default.name  role     = "roles/storage.objectViewer"  member   = "allUsers"}

REST APIs

Console

1. In the Google Cloud console, go to the Cloud StorageBuckets page.
   

   Go to Buckets

2. Click the name of the bucket that contains the objects you want tomake public.

3. Create a folder, using the following steps:

   1. Click theCreate folder button.

   2. Enter theName for the folder. Once the folder is converted to amanaged folder, objects whose name start with this name will besubject to IAM roles set on the folder.

   3. ClickCreate.

4. Convert the folder to a managed folder, using the following steps:

   1. In the pane that shows the bucket's contents, find the name of thefolder you created, and click theMore options iconmore_vert.

   2. ClickEdit access.

   3. In the window that appears, clickEnable.

5. Add an IAM policy to the folder that grantsallUsers theStorage Object Viewer (roles/storage.objectViewer) role, using thefollowing steps:

   1. If thePermissions pane for your managed folder isn't alreadyopen, click theMore options iconmore_vert for the managedfolder, and then clickEdit access.

   2. In thePermissions pane, click theperson_addAdd principalbutton.

   3. In theNew principals field, enterallUsers.

   4. In theSelect a role drop down, enterStorage Object Viewerin the filter box, and selectStorage Object Viewer from thefiltered results.

   5. ClickSave.

   6. ClickAllow public access.

Once public access has been granted, aCopy URL button appears for eachapplicable object in thepublic access column. You can click this buttonto get the public URL for the object. The public URL is different from thelink you get from directly right-clicking an object. Both links provideaccess to an object, but the public URL works without the user having tosign into a user account. SeeRequest endpoints for more information.

To learn how to get detailed error information about failed Cloud Storage operations in the Google Cloud console, seeTroubleshooting.

Command line

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. In your development environment, create a managed folder using thegcloud storage managed-folders create command:

   gcloud storage managed-folders create gs://BUCKET_NAME/MANAGED_FOLDER_NAME/

   Where:

   • BUCKET_NAME is the name of the bucket in whichyou want to create a managed folder. For example,my-bucket.

   • MANAGED_FOLDER_NAME is the name of the managedfolder you want to create. For example,my-managed-folder.

3. In your development environment, addallUsers to the managed folder'sIAM policy using thegcloud storage managed-folders add-iam-policy-binding command:

   gcloud storage managed-folders add-iam-policy-binding gs://BUCKET_NAME/MANAGED_FOLDER_NAME --member=allUsers --role=roles/storage.objectViewer

   Where:

   • BUCKET_NAME is the name of the bucketcontaining the managed folder you're adding the IAMpolicy to. For example,my-bucket.
   • MANAGED_FOLDER_NAME is the name of the managedfolder that you want to add public access to. For example,my-managed-folder.

REST APIs

<AccessControlList>  <Entries>    <Entry>      <Scope type="AllUsers"/>      <Permission>READ</Permission>    </Entry>  </Entries></AccessControlList>

Console

1. In the Google Cloud console, go to the Cloud StorageBuckets page.
   

   Go to Buckets

2. In the list of buckets, click the name of the bucket you want toremove public access from.

3. Select thePermissions tab.

   The IAM policy that applies to the bucket appears inthePermissions section.

4. In theView by principals tab, select the checkbox for theallUsers principal you're removing.

5. Click the- Remove access button.

6. In the overlay window that appears, clickConfirm.

To learn how to get detailed error information about failed Cloud Storage operations in the Google Cloud console, seeTroubleshooting.

Command line

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. In your development environment, run thebuckets remove-iam-policy-binding command:

gcloud storage buckets remove-iam-policy-binding  gs://BUCKET_NAME --member=allUsers --role=roles/storage.objectViewer

WhereBUCKET_NAME is the name of the bucket you are revoking access to. For example,my-bucket.

REST APIs