Managing Cloud Storage

What it is

Operating Cloud Storage means controlling who can access objects, automating lifecycle changes such as moving or deleting old data, estimating costs, and protecting data with customer-managed encryption keys (CMEK) where required.

How it works

Securing objects

gcloud storage buckets add-iam-policy-binding gs://reports-1234 \
  --member="group:analysts@example.com" --role="roles/storage.objectViewer"

gcloud storage buckets update gs://reports-1234 --uniform-bucket-level-access
gcloud storage sign-url gs://reports-1234/q3.pdf --duration=1h --private-key-file=key.json

Lifecycle management

Object Lifecycle Management applies rules to objects automatically: change storage class or delete based on conditions such as age, creation date, number of newer versions or storage class.

{
  "rule": [
    {"action": {"type": "SetStorageClass", "storageClass": "NEARLINE"}, "condition": {"age": 30}},
    {"action": {"type": "SetStorageClass", "storageClass": "COLDLINE"}, "condition": {"age": 90}},
    {"action": {"type": "Delete"}, "condition": {"age": 365}}
  ]
}

gcloud storage buckets update gs://logs-1234 --lifecycle-file=lifecycle.json

With versioning, a rule such as numNewerVersions deletes old versions so costs do not grow forever. Use Autoclass instead of rules when access patterns are unknown.

Estimating storage costs

Cloud Storage cost has several parts:

Use the Google Cloud Pricing Calculator to estimate, and billing reports to track actual costs. The same approach applies to database storage: size, replication and backups drive cost.

Customer-managed encryption keys (CMEK)

All data is encrypted at rest by default with Google-managed keys. CMEK uses keys you control in Cloud KMS:

1. Create a key ring and key in Cloud KMS, in a location compatible with the bucket.
2. Grant the Cloud Storage service agent the role Cloud KMS CryptoKey Encrypter/Decrypter on the key.
3. Set the key as the bucket's default key.

gcloud storage buckets update gs://records-1234 \
  --default-encryption-key=projects/PROJECT/locations/us-central1/keyRings/ring/cryptoKeys/records-key

CMEK gives control over rotation and the ability to disable the key, which makes data unreadable. Other services such as BigQuery, Cloud SQL and Compute Engine disks support CMEK in a similar way.

A worked scenario

A company stores application logs that are read for a month and kept for a year. It sets a lifecycle policy moving logs to Nearline at 30 days, Coldline at 90 days and deleting at 365 days. Its HR bucket uses uniform bucket-level access, public access prevention and a CMEK key from Cloud KMS. Auditors receive signed URLs valid for one day. Before the change, the team estimated savings with the Pricing Calculator.

How the exam asks about this

• "Delete objects older than a year automatically." A lifecycle rule with an age condition.
• "Only IAM should control access to the bucket." Uniform bucket-level access.
• "Temporary download link without a Google account." A signed URL.
• "The company must control and rotate its own encryption keys." CMEK with Cloud KMS.