• CRITICAL
  • IAM
  • OBJECTS
  • HUMAN

How to audit bucket permissions with your AI

Connect your AI to Google Cloud Storage to scan for exposed data. Once connected, your agent handles the heavy lifting of inspecting access controls.

Ask AI about this page

Short answer

How can I use AI to audit my GCS bucket permissions?

Your AI pulls IAM policies and ACLs for your buckets and objects to find public or overly permissive settings. You'll get a clear list of security gaps to fix.

Audit outcomes

Where your findings land.

The AI organizes its findings into these categories.

CRITICAL

Public access detected

The AI identifies buckets or objects with open ACLs. You get a direct list of what anyone on the internet can see.

IAM

Policy misconfigurations

The agent reviews IAM bindings to find users or service accounts with more power than they need.

OBJECTS

Individual file risks

It looks at specific object permissions to catch files that were accidentally made public.

HUMAN

Remediation required

The AI identifies the issues but won't change your settings. You decide which permissions to strip or tighten.

The workflow

What your AI does when the audit starts.

The AI moves through your storage hierarchy to map out exactly who has access to what.

  1. Map bucket access

    The agent pulls the IAM policy for a specific bucket to see which identities have roles assigned.

    get_bucket_iam

  2. Check bucket ACLs

    It inspects the bucket-level access control lists to find legacy public permissions.

    list_bucket_acl

  3. Inspect object permissions

    The AI drills down into individual files to check for specific object-level access.

    list_object_acl

  4. Flag exposure

    The agent compares the retrieved permissions against security best practices to highlight risks.

    list_bucket_acllist_object_acl

Try it

Copy these to start.

Use these prompts to kick off your audit.

Starting points

Replace the bucket names with your actual GCS bucket IDs.

Google Cloud Storage Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_HZ0fp8h3qE7JPzT1zEcEb6LOl8tyB00DqcCfsN2D/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Google Cloud Storage capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "google-cloud-storage-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_HZ0fp8h3qE7JPzT1zEcEb6LOl8tyB00DqcCfsN2D/mcp"
    }
  }
}
Copy into chat04

  • Check the IAM policy for my bucket 'production-data-logs' and tell me if any service accounts have owner access.

  • List all buckets in my project and tell me which ones have public access enabled via ACLs.

  • Audit the permissions for the object 'config/settings.json' in my 'app-assets' bucket.

  • Find any buckets in my project that have 'allUsers' or 'allAuthenticatedUsers' in their ACLs.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Google Cloud Storage once, then ask.

Just link your account through the Vinkius dashboard. Your credentials stay encrypted, and you can immediately start asking your AI about your storage security.

Connect Google Cloud Storage to your AI

FAQ

How this task behaves.

  • 01

    Can the AI change my bucket permissions?

    No. The AI can only read IAM policies and ACLs. You must manually update permissions in the Google Cloud Console or via CLI.

  • 02

    Does the AI scan every single object in my bucket?

    The AI only scans objects if you specifically ask it to check an object's ACL or if you ask it to audit all objects in a bucket.

  • 03

    Can the AI create new IAM roles?

    No. The available tools are limited to reading existing IAM and ACL data.

  • 04

    How does the AI know if a bucket is public?

    It looks for specific identifiers like 'allUsers' or 'allAuthenticatedUsers' within the ACLs it retrieves.

  • 05

    Will this work with my existing service accounts?

    Yes. The AI reads the IAM policies to see which service accounts are currently assigned to your buckets.

  • More questions about Google Cloud Storage? The Connector page answers them. See everything the Google Cloud Storage Connector can do

Connect Google Cloud Storage to Claude, Cursor, ChatGPT & more