CODEWITHSUNDEEP
google-cloud-storagegoogle-compute-engine
Julius Žaromskis
Julius Žaromskis

Reputation: 2255

Google storage public file security - access without a link?

I need to use google cloud storage to store some files that can contain sensitive information. File names will be generated using crypto function, and thus unguessable. Files will be made public.

Is it safe to assume that the file list will not be available to public ? I.e. file can only be accessed by someone who knows the file name.

I have ofc tried accessing the parent dir and bucket, and I do get rejected with unauthenticated error. I am wondering if there is or will ever be any other way to list the files.

Upvotes: 1

Views: 261

Answers (2)

Brandon Yarbrough
Brandon Yarbrough

Reputation: 38389

Yes, but keep in mind that the ability to list objects in a bucket is allowed for anyone with read permission or better on the bucket itself. If your object names are secret, make sure to keep the bucket's read permissions locked down as much as possible.

jterrace's suggestion about preferring signed URLs is a good one. The major downside to obscure object names is that it's very difficult to remove access to a particular entity later without deleting the resource entirely.

Upvotes: 0

jterrace
jterrace

Reputation: 67093

Yes, that is a valid approach to security through obscurity. As long as the ACL to list the objects in a bucket is locked down, your object names should be unguessable.

However, you might consider using Signed URLs instead. They can have an expiration time set so it provides extra security in case your URLs are leaked.

Upvotes: 3

Related Questions