GCS buckets in a project

Lists every Cloud Storage bucket in a single project. Bucket listing is per-project, so an org-wide storage inventory iterates the projects from google/cloudresourcemanager/projects-by-parent and runs this query for each.

Query

SELECT name, location, storageClass, timeCreated
FROM google.storage.buckets
WHERE project = '{{project}}';

Variation: public access and access control posture

iamConfiguration carries the two settings that decide whether a bucket can be made public - uniform bucket-level access, and the public access prevention mode:

SELECT
name,
location,
JSON_EXTRACT(iamConfiguration, '$.uniformBucketLevelAccess.enabled') AS uniform_access,
JSON_EXTRACT(iamConfiguration, '$.publicAccessPrevention') AS public_access_prevention
FROM google.storage.buckets
WHERE project = '{{project}}';

Notes

The parameter is project here, spelled as the project id rather than the projectsId form the IAM API uses - the naming is not consistent across Google services, so check the required params per resource rather than assuming. Bucket names are globally unique across all of GCS, not just the project, which is why a create can fail on a name already taken by another organisation. location is a region such as us-central1 or a multi-region such as US or EU; multi-region buckets replicate across a continent and cost more per GB. Buckets carry no project column in the response, so the project scoping comes entirely from the request parameter - when sweeping several projects, carry the project id through from the loop rather than expecting it in the result.