Create or update IP filtering rules on an existing bucket

JSON API

1. Have gcloud CLI installed and initialized , which lets you generate an access token for the Authorization header.

2. Create a JSON file that contains the settings for the bucket, which must include the name and the ipFilter configuration fields for the bucket. For examples and information about how to structure the bucket IP filtering rules, see Bucket IP filtering configurations .

    { 
     
    "ipFilter" 
    :{ 
     
    "mode" 
    : 
    " MODE 
   " 
    , 
     
    "publicNetworkSource" 
    :{ 
     
    "allowedIpCidrRanges" 
    :[ 
     
    " RANGE_CIDR 
   " 
    , 
     
    "..." 
     
    ] 
     
    }, 
     
    "vpcNetworkSources" 
    :[ 
     
    { 
     
    "network" 
    : 
    "projects/ PROJECT_ID 
   /global/networks/ NETWORK_NAME 
   " 
    , 
     
    "allowedIpCidrRanges" 
    :[ 
     
    " RANGE_CIDR 
   " 
    , 
     
    "..." 
     
    ] 
     
    }, 
     
    "..." 
     
    ], 
     
    "allowCrossOrgVpcs" 
    : 
     
     ALLOW_CROSS_ORG_VPCS 
    
    , 
     
    "allowAllServiceAgentAccess" 
    : 
     
     ALLOW_ALL_SERVICE_AGENT_ACCESS 
    
     
    } 
    } 
   

   Where:

   • MODE is the state of the IP filter configuration. Valid values are Enabled and Disabled . When set to Enabled , IP filtering rules are applied to a bucket and all incoming requests to the bucket are evaluated against these rules. When set to Disabled , all incoming requests can access the bucket and its data without any evaluation.

   • RANGE_CIDR is a public network IPv4 or IPv6 address range that's allowed to access the bucket. You can enter one or multiple address ranges as a list.

   • PROJECT_ID is the project ID where the VPC network exists. To configure multiple VPC networks, you need to specify the project where each network is located.

   • NETWORK_NAME is the name of the VPC network that is allowed to access the bucket. To configure multiple VPC networks, you need to specify a name for each network.

   • ALLOW_ALL_SERVICE_AGENT_ACCESS is a boolean value that indicates whether to allow service agents to access the bucket, regardless of the IP filter configuration. If the value is true , other Google Cloud services can use service agents to access the bucket without IP-based validation.

   • ALLOW_CROSS_ORG_VPCS is a boolean value that indicates whether to allow VPC networks that are defined in the vpcNetworkSources list to originate from a different organization. This field is optional. If set to true , the request allows cross-organizational VPC networks. If set to false , the request restricts the VPC networks to the same organization as the bucket. If not specified, the default value is false . This field applies only if vpcNetworkSources is not empty.

3. Use cURL to call the JSON API with a PATCH bucket request:

   curl -X PATCH --data-binary @ JSON_FILE_NAME 
   \
    -H "Authorization: Bearer $(gcloud auth print-access-token)" \
    -H "Content-Type: application/json" \
    "https://storage.googleapis.com/storage/v1/b/ BUCKET_NAME 
   ?project= PROJECT_IDENTIFIER 
   "

   Where:

   • JSON_FILE_NAME is name of the JSON file you created in the preceding step.
   • BUCKET_NAME is the name of your bucket.
   • PROJECT_IDENTIFIER is the ID or number of the project with which your bucket is associated. For example, my-project .