Some or all of the information on this page might not apply to Trusted Cloud by S3NS. See Differences from Google Cloud for more details.

Create or update IP filtering rules on an existing bucket

This page describes how to create or update the bucket IP filtering rules on an existing bucket.

Required roles

To get the required permissions for updating the IP filtering rules on a bucket, ask your administrator to grant you the Storage Admin (roles/storage.admin) role on the bucket. This role contains the permissions required to update bucket IP filtering rules.

To see the exact permissions that are required, expand the Required permissions section:

Required permissions

storage.buckets.update
storage.buckets.setIpFilter

You can also get these permissions with custom roles. You might be able to get these permissions with other predefined roles as well. To see which roles are associated with which permissions, refer to IAM roles for Cloud Storage.

For instructions on granting roles for projects, see Manage access to projects.

Create or update IP filtering rules on an existing bucket

gcloud

Verify that you have the Google Cloud CLI version 526.0.0 or later installed:
```
gcloud version | head -n1
```
If you have an earlier gcloud CLI version installed, update the version:
```
gcloud components update --version=526.0.0
```
Create a JSON file that defines rules for incoming requests. For examples and information about how to structure the bucket IP filtering rules, see Bucket IP filtering configurations.
```
    {
      "mode":"MODE",
      "publicNetworkSource":{
          "allowedIpCidrRanges":[
            "RANGE_CIDR",
            "..."
          ]
      },
      "vpcNetworkSources":[
          {
            "network":"projects/PROJECT_ID/global/networks/NETWORK_NAME",
            "allowedIpCidrRanges":[
                "RANGE_CIDR",
                "..."
            ]
          },
          "..."
      ],
      "allowCrossOrgVpcs": ALLOW_CROSS_ORG_VPCS,
      "allowAllServiceAgentAccess": ALLOW_ALL_SERVICE_AGENT_ACCESS
    }
    
```
Where:
- MODE is the mode of the bucket IP filtering configuration. Valid values are Enabled and Disabled. When set to Enabled, IP filtering rules are applied to a bucket. Any incoming request to the bucket is evaluated against these rules. When set to Disabled, all incoming requests are allowed to access the bucket.
- RANGE_CIDR is a public network IPv4 or IPv6 address range that's allowed to access the bucket. You can enter one or multiple address ranges as a list.
- PROJECT_ID is the project ID where the Virtual Private Cloud (VPC) network exists. To configure multiple VPC networks, you need to specify the project where each network is located.
- NETWORK_NAME is the name of the VPC network that is allowed to access the bucket. To configure multiple VPC networks, you need to specify a name for each network.
- ALLOW_CROSS_ORG_VPCS is a boolean value that indicates whether to allow VPC networks that are defined in vpcNetworkSources to originate from a different organization. This field is optional. If set to true, the request allows cross-organizational VPC networks. If set to false, the request restricts the VPC networks to the same organization as the bucket. If not specified, the default value is false. This field applies only if vpcNetworkSources is not empty.
- ALLOW_ALL_SERVICE_AGENT_ACCESS is a boolean value that indicates whether to allow service agents to access the bucket, regardless of the IP filter configuration. If the value is true, other Trusted Cloud services can use service agents to access the bucket without IP-based validation.
To update bucket IP filtering rules, run the gcloud alpha storage buckets update command in your development environment:
```
gcloud alpha storage buckets update gs://BUCKET_NAME --ip-filter-file=IP_FILTER_CONFIG_FILE
```
Where:
- BUCKET_NAME is the name of your bucket. For example, my-bucket.
- IP_FILTER_CONFIG_FILE is the JSON file created in the preceding step.

REST APIs

JSON API

Have gcloud CLI installed and initialized , which lets you generate an access token for the Authorization header.

Create a JSON file that contains the settings for the bucket, which must include the name and the ipFilter configuration fields for the bucket. For examples and information about how to structure the bucket IP filtering rules, see Bucket IP filtering configurations.
```
{
  "ipFilter":{
      "mode":"MODE",
      "publicNetworkSource":{
        "allowedIpCidrRanges":[
            "RANGE_CIDR",
            "..."
        ]
      },
      "vpcNetworkSources":[
        {
            "network":"projects/PROJECT_ID/global/networks/NETWORK_NAME",
            "allowedIpCidrRanges":[
              "RANGE_CIDR",
              "..."
            ]
        },
        "..."
      ],
      "allowCrossOrgVpcs": ALLOW_CROSS_ORG_VPCS,
      "allowAllServiceAgentAccess": ALLOW_ALL_SERVICE_AGENT_ACCESS
  }
}
```
Where:
- MODE is the state of the IP filter configuration. Valid values are Enabled and Disabled. When set to Enabled, IP filtering rules are applied to a bucket and all incoming requests to the bucket are evaluated against these rules. When set to Disabled, all incoming requests can access the bucket and its data without any evaluation.
- RANGE_CIDR is a public network IPv4 or IPv6 address range that's allowed to access the bucket. You can enter one or multiple address ranges as a list.
- PROJECT_ID is the project ID where the VPC network exists. To configure multiple VPC networks, you need to specify the project where each network is located.
- NETWORK_NAME is the name of the VPC network that is allowed to access the bucket. To configure multiple VPC networks, you need to specify a name for each network.
- ALLOW_ALL_SERVICE_AGENT_ACCESS is a boolean value that indicates whether to allow service agents to access the bucket, regardless of the IP filter configuration. If the value is true, other Trusted Cloud services can use service agents to access the bucket without IP-based validation.
- ALLOW_CROSS_ORG_VPCS is a boolean value that indicates whether to allow VPC networks that are defined in the vpcNetworkSources list to originate from a different organization. This field is optional. If set to true, the request allows cross-organizational VPC networks. If set to false, the request restricts the VPC networks to the same organization as the bucket. If not specified, the default value is false. This field applies only if vpcNetworkSources is not empty.
Use cURL to call the JSON API with a PATCH bucket request:
```
curl -X PATCH --data-binary @JSON_FILE_NAME \
 -H "Authorization: Bearer $(gcloud auth print-access-token)" \
 -H "Content-Type: application/json" \
 "https://storage.s3nsapis.fr/storage/v1/b/BUCKET_NAME?project=PROJECT_IDENTIFIER"
```
Where:
- JSON_FILE_NAME is name of the JSON file you created in the preceding step.
- BUCKET_NAME is the name of your bucket.
- PROJECT_IDENTIFIER is the ID or number of the project with which your bucket is associated. For example, my-project.

What's next

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-08-07 UTC.