Disable bucket IP filtering

This page describes how to disable bucket IP filtering.

Deleting the bucket IP filtering rules disables IP filtering on a bucket, meaning you can remove the network-level access restrictions and enable requests from any IP address to access the bucket.

Required roles

To get the required permissions for disabling bucket IP filtering, ask your administrator to grant you the Storage Admin (roles/storage.admin) role on the bucket. This role contains the permissions required to disable bucket IP filtering.

To see the exact permissions that are required, expand the Required permissions section:

Required permissions

  • storage.buckets.update
  • storage.buckets.setIpFilter

You can also get these permissions with custom roles. You might be able to get these permissions with other predefined roles as well. To see which roles are associated with which permissions, refer to IAM roles for Cloud Storage.

For instructions on granting roles on buckets, see Use IAM with buckets.

Disable bucket IP filtering rules

gcloud

  1. Verify that you have the Google Cloud CLI version 526.0.0 or later installed:

    gcloud version | head -n1

  2. If you have an earlier gcloud CLI version installed, update the version:

    gcloud components update --version=526.0.0

  3. To disable bucket IP filtering, run the gcloud alpha storage buckets update command in your development environment:

    gcloud alpha storage buckets update gs://BUCKET_NAME --clear-ip-filter

    Where:

    BUCKET_NAME is the name of your bucket. For example, my-bucket.

REST APIs

JSON API

  1. Have gcloud CLI installed and initialized, which lets you generate an access token for the Authorization header.

  2. Create a JSON file that contains the settings for the bucket, which must include the mode of IP filter configuration. Set the mode field to Disabled.

    {
  "ipFilter": {
    "mode": "Disabled",
    "publicNetworkSource": null,
    "vpcNetworkSources": []
    }
}

  3. Use cURL to call the JSON API with a PATCH bucket request:

    curl -X PATCH --data-binary @JSON_FILE_NAME \
 -H "Authorization: Bearer $(gcloud auth print-access-token)" \
 -H "Content-Type: application/json" \
 "https://storage.s3nsapis.fr/storage/v1/b/BUCKET_NAME?project=PROJECT_IDENTIFIER"

    Where:

    • JSON_FILE_NAME is name of the JSON file that contains the settings for the bucket.
    • BUCKET_NAME is the name of your bucket.
    • PROJECT_IDENTIFIER is the ID or number of the project with which your bucket is associated. For example, my-project.

What's next