Skip to content

Cloud Storage

Jump to bottom
Anna edited this page Jun 25, 2026 · 1 revision

Module: Cloud Storage

Module flag: storage Enabled by default: yes

Overview

The Cloud Storage module provides bucket and object inventory. Use it to audit bucket configuration (versioning, lifecycle, uniform access control, public access prevention) and list objects with optional prefix filtering.

Enable This Module

GCP_PROJECT_ID=my-project ./aura-tracker-gcp --modules storage

Required GCP APIs

gcloud services enable storage.googleapis.com

Required IAM Permissions

Role Tools that need it
roles/storage.objectViewer All tools

Tools

gcp_storage_list_buckets

Lists all Cloud Storage buckets in the project.

Parameters:

Name Required Description
project_id yes GCP project ID

Returns: Bucket name, location, storage class, creation time, labels, retention policy (if set).

gcp_storage_get_bucket_metadata

Gets detailed metadata for a single bucket.

Parameters:

Name Required Description
project_id yes GCP project ID
bucket_name yes Bucket name

Returns: Versioning (enabled/disabled), lifecycle rules (action + condition), uniform bucket-level access (enabled/disabled), public access prevention (enforced/inherited), CORS configuration, default KMS key, soft delete policy, retention policy.

gcp_storage_list_bucket_objects

Lists objects in a bucket, with optional prefix filtering (returns up to 1000 objects).

Parameters:

Name Required Description
project_id yes GCP project ID
bucket_name yes Bucket name
prefix no Object name prefix filter
limit no Max objects to return (default: 1000)

Returns: Object name, size (bytes), content type, storage class, create time, update time, MD5 hash.

MCP Resources

The following MCP resources are always available for Cloud Storage:

  • gcp://{project}/storage/buckets — All buckets with basic metadata
  • gcp://{project}/storage/{bucket} — Full metadata for a single bucket
  • gcp://{project}/storage/{bucket}/objects — Bucket config summary

Prompt Examples

Inventory

"List all Cloud Storage buckets in project my-project and their locations."

Public access audit

"Which buckets in project my-project do not have public access prevention enforced?"

Versioning audit

"Which buckets in project my-project have versioning disabled?"

Lifecycle audit

"List buckets in project my-project that have no lifecycle rules configured."

Object listing

"Show me the objects in my-backup-bucket with the prefix 2024/01/."

Related Modules

Module flag Why you'd combine it
iam Audit bucket IAM bindings (allUsers, allAuthenticatedUsers)
secretmanager Compare with secrets — buckets sometimes store service credentials
archgraph Include Storage buckets in the full architecture graph

Clone this wiki locally