feat(storage): Support bucket encryption config by shubhangi-google · Pull Request #33452 · googleapis/google-cloud-ruby

shubhangi-google · 2026-03-30T03:06:18Z

This pull request significantly enhances the Google Cloud Storage client library by introducing comprehensive support for managing bucket encryption enforcement configurations. Users can now define and enforce default encryption behaviors for their buckets and files using customer-managed, customer-supplied, or Google-managed encryption keys. The changes provide robust API methods, update internal mechanisms for handling these configurations, and include practical examples and tests to ensure functionality and ease of use.

Highlights

New Bucket Encryption Configuration Methods: Added new methods to Google::Cloud::Storage::Bucket for managing customer-managed, customer-supplied, and Google-managed encryption enforcement configurations, including getters and setters for customer_managed_encryption_enforcement_config, customer_supplied_encryption_enforcement_config, and google_managed_encryption_enforcement_config.
Unified Encryption Update Method: Introduced a new update_bucket_encryption_enforcement_config method to handle updates for different types of bucket encryption enforcement configurations in a unified manner.
Enhanced patch_gapi! Method: Modified the internal patch_gapi! method to accept an optional bucket_encryption_config parameter, allowing more flexible patching of encryption-related attributes.
New Samples and Acceptance Tests: Included new samples and corresponding acceptance tests to demonstrate how to get, set, update, and remove bucket encryption enforcement configurations.
Gemfile Updates: Added ostruct, cgi, and irb gems to the Gemfile for samples, addressing gems removed from Ruby core that are required for testing.

This Pr was created as old PR got corrupted - #32778, #32786

Fix missing newline at end of file in bucket_encryption_test.rb

snippet-bot · 2026-03-30T06:48:38Z

Here is the summary of changes.

You are about to add 3 region tags.

google-cloud-storage/samples/storage_get_bucket_encryption_enforcement_config.rb:15, tag storage_get_bucket_encryption_enforcement_config
google-cloud-storage/samples/storage_set_bucket_encryption_enforcement_config.rb:15, tag storage_set_bucket_encryption_enforcement_config
google-cloud-storage/samples/storage_update_bucket_encryption_enforcement_config.rb:17, tag storage_update_bucket_encryption_enforcement_config

This comment is generated by snippet-bot.
If you find problems with this result, please file an issue at:
https://github.com/googleapis/repo-automation-bots/issues.
To update this comment, add snippet-bot:force-run label or use the checkbox below:

Refresh this comment

Removed an unnecessary blank line before the encryption configuration documentation.

Removed unnecessary comment line in bucket.rb

Removed unnecessary comment line in bucket.rb.

Removed unnecessary comment line in bucket.rb

bajajneha27 · 2026-04-02T04:30:20Z

google-cloud-storage/acceptance/storage/bucket_encryption_test.rb

+    end
+
+    it "deletes all encryption enforcement configs" do
+      # For the update, need to specify all three configs


Not sure if this statement is correct

got reference from Java pr

@nidhiii-27 Is this correct statement?

bajajneha27 · 2026-04-02T04:36:44Z

google-cloud-storage/lib/google/cloud/storage/bucket.rb

+        #   #
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #   bucket.customer_managed_encryption_enforcement_config #=> Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig.new


nit: are we also planning to provide the setter using a hash?

@bajajneha27 did not understand your concerns here
we are performing the operation as below
#set operation
customer_managed_config =
Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig.new(
restriction_mode: "NotRestricted"
)
customer_managed_encryption_enforcement_config = customer_managed_config

#get operation
bucket.customer_managed_encryption_enforcement_config
#<Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig:0x00007f64e9a69dc0
@effective_time=#<DateTime: 2026-04-02T10:09:23+00:00 ((2461133j,36563s,115000000n),+0s,2299161j)>,
@restriction_mode="FullyRestricted">

What I meant to ask is that, can we use the setter in following way as well:

bucket.customer_managed_config = { restriction_mode: "NotRestricted"

Because we usually do that in this codebase.

modified the samples

bajajneha27 · 2026-04-02T04:37:55Z

google-cloud-storage/lib/google/cloud/storage/bucket.rb

+        #   #
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #   bucket.customer_managed_encryption_enforcement_config #=> Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig.new


This comment is confusing. This is a getter method, so ideally we should be showing code sample for that.

A gentle reminder on this

modified the samples

bajajneha27 · 2026-04-02T04:41:51Z

google-cloud-storage/lib/google/cloud/storage/bucket.rb

+        #
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #   bucket.customer_supplied_encryption_enforcement_config #=> Google::Apis::StorageV1::Bucket::Encryption::CustomerSuppliedEncryptionEnforcementConfig.new


Same comment as above.

modified the samples

bajajneha27 · 2026-04-02T04:42:43Z

google-cloud-storage/lib/google/cloud/storage/bucket.rb

+        #
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #   bucket.google_managed_encryption_enforcement_config #=> Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig.new


Same comment here as well

modified the samples

bajajneha27 · 2026-04-02T04:43:43Z

google-cloud-storage/lib/google/cloud/storage/bucket.rb

                        if_metageneration_match: nil,
-                        if_metageneration_not_match: nil
+                        if_metageneration_not_match: nil,
+                        bucket_encryption_config: nil


Why are we introducing new parameter here? Why can't we combine this in existing parameter attributes ?

When using the standard bucket.update or @gapi.send(:encryption) patterns, the Ruby SDK was capturing the entire existing encryption state. This included server-generated fields like effectiveTime. When this "polluted" object was sent back via the PATCH API, Google rejected it with an InvalidArgumentError because those fields were not in the expected format.

The Fix

We implemented the update_bucket_encryption_enforcement_configmethod to send only the changed data to the patch request.

How it Works

Isolation: Instead of modifying the existing bucket object, the method initializes a fresh, empty Google::Apis::StorageV1::Bucket::Encryption instance.

Specific Assignment: It uses dynamic dispatch (public_send) to set only the specific enforcement type requested (e.g., customer_supplied).

update_bucket_encryption_enforcement_config sends the correct patch json in bucket_encryption_config

Comparison of JSON Payloads

Wrong Request (Polluted)

{ "encryption": { "customerManagedEncryptionEnforcementConfig": { "restrictionMode": "NotRestricted" }, "customerSuppliedEncryptionEnforcementConfig": { "restrictionMode": "NotRestricted" }, "googleManagedEncryptionEnforcementConfig": { "effectiveTime": "2026-03-25T11:40:17.182+00:00", "restrictionMode": "FullyRestricted" } } }

Correct request

{ "encryption": { "customerManagedEncryptionEnforcementConfig": { "restrictionMode": "NotRestricted" } } }

@bajajneha27 can you please provide your views on this approach

User can still pass effectiveTime if they want to, in the new attribute.
I think we should not add a separate parameter just for this. We should make use of existing attribute

Besides, if user wants to update other attributes AND bucket_encryption_configs, that won't work
https://github.com/googleapis/google-cloud-ruby/pull/33452/changes#diff-1c445f12b16180bcbdde4cab77c9b5ca55acc3fff5a45c1dd7d2bb4abb64bf76R3410-R3414

Hi @bajajneha27 the existing patch method is sending all the encryption attribute (the existing one and the updated patch together)
as shown in this example #33452 (comment)
here the time format which we are receiving is UTC format from server and API is expecting RFC 3339 format as per encryption.googleManagedEncryptionEnforcementConfig.effectiveTime hence we are getting invalid argument error in response
as a solution I am creating a new method to update the encryption enforcement config which will send only the updated patch
this method is only for handling encryption_config so concern for other attributes will not be valid in this case

google-cloud-storage/samples/Gemfile

google-cloud-storage/test/google/cloud/storage/bucket_encryption_test.rb

google-cloud-storage/test/helper.rb

bajajneha27 · 2026-04-06T08:25:07Z

google-cloud-storage/acceptance/storage/bucket_encryption_test.rb

+    end
+
+    it "deletes all encryption enforcement configs" do
+      # For the update, need to specify all three configs


@nidhiii-27 Is this correct statement?

bajajneha27 · 2026-04-06T08:27:44Z

google-cloud-storage/lib/google/cloud/storage/bucket.rb

+        #   #
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #   bucket.customer_managed_encryption_enforcement_config #=> Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig.new


What I meant to ask is that, can we use the setter in following way as well:

bucket.customer_managed_config = { restriction_mode: "NotRestricted"

Because we usually do that in this codebase.

bajajneha27 · 2026-04-06T08:28:17Z

google-cloud-storage/lib/google/cloud/storage/bucket.rb

+        #   #
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #   bucket.customer_managed_encryption_enforcement_config #=> Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig.new


A gentle reminder on this

bajajneha27 · 2026-04-06T08:30:55Z

google-cloud-storage/lib/google/cloud/storage/bucket.rb

+        #   bucket.update_bucket_encryption_enforcement_config new_config
+        #
+        def update_bucket_encryption_enforcement_config incoming_config
+          attr_name = case incoming_config


AFAIU, this code will work only if we update just one config. What if I want to update multiple configs at the same time? For ex. GoogleManagedEncryptionEnforcementConfig and CustomerManagedEncryptionEnforcementConfig

modified the code now the code will work for the hash we receive

bajajneha27 · 2026-04-06T08:32:18Z

google-cloud-storage/lib/google/cloud/storage/bucket.rb

+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #   
+        #   new_config = Google::Apis::StorageV1::Bucket::Encryption::CustomerSuppliedEncryptionEnforcementConfig.new restriction_mode: "NotRestricted"


The code sample here is for setting the config while the method is a getter here. We should update the sample to show how to use the getter method

modified the samples

bajajneha27 · 2026-04-06T08:33:05Z

google-cloud-storage/lib/google/cloud/storage/bucket.rb

+        #
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #   new_config= Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig.new restriction_mode: "NotRestricted"


Same comment as above. This is a setter example

modified the samples

bajajneha27 · 2026-04-06T08:35:03Z

google-cloud-storage/lib/google/cloud/storage/bucket.rb

                        if_metageneration_match: nil,
-                        if_metageneration_not_match: nil
+                        if_metageneration_not_match: nil,
+                        bucket_encryption_config: nil


User can still pass effectiveTime if they want to, in the new attribute.
I think we should not add a separate parameter just for this. We should make use of existing attribute

bajajneha27 · 2026-04-06T08:39:20Z

google-cloud-storage/lib/google/cloud/storage/bucket.rb

                        if_metageneration_match: nil,
-                        if_metageneration_not_match: nil
+                        if_metageneration_not_match: nil,
+                        bucket_encryption_config: nil


Besides, if user wants to update other attributes AND bucket_encryption_configs, that won't work
https://github.com/googleapis/google-cloud-ruby/pull/33452/changes#diff-1c445f12b16180bcbdde4cab77c9b5ca55acc3fff5a45c1dd7d2bb4abb64bf76R3410-R3414

bajajneha27 · 2026-04-06T08:41:43Z

google-cloud-storage/test/google/cloud/storage/bucket_encryption_test.rb

      bucket_with_key = Google::Cloud::Storage::Bucket.from_gapi bucket_gapi_with_key, storage.service
-      patch_bucket_gapi = Google::Apis::StorageV1::Bucket.new encryption: encryption_gapi(nil)
+      patch_bucket_gapi = Google::Apis::StorageV1::Bucket.new encryption: encryption_gapi(key_name: kms_key)
+      patch_bucket_gapi = Google::Apis::StorageV1::Bucket.new(


Why are we just overwriting the variable patch_bucket_gapi ?

was a mistake corrected it

shubhangi-google added 10 commits March 25, 2026 08:48

adding ostruct gem in samples

598851a

adding functionality

53ee419

Add newline at end of bucket_encryption_test.rb

be44e07

Fix missing newline at end of file in bucket_encryption_test.rb

renaming tags

96e3fa2

adding update functionality

3658979

adding tests

221d38b

fixing rubocop issue

a0ddae3

removing unwanted code

87a5e37

updating update sample

d01e6d1

update

a21d625

shubhangi-google marked this pull request as ready for review March 30, 2026 06:48

shubhangi-google requested review from a team and yoshi-approver as code owners March 30, 2026 06:48

cpriti-os added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Mar 30, 2026

yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Mar 30, 2026

shubhangi-google added 8 commits March 30, 2026 14:47

Remove unnecessary line in bucket encryption test

2d5b5e3

fix

67e25f9

Remove blank line in bucket.rb

69e6fd9

Removed an unnecessary blank line before the encryption configuration documentation.

Clean up comments in bucket.rb

f88d02e

Removed unnecessary comment line in bucket.rb

Clean up comments in bucket.rb

27632c6

Removed unnecessary comment line in bucket.rb.

Clean up comments in bucket.rb

794c7cc

Removed unnecessary comment line in bucket.rb

Remove unnecessary line in encryption config update

d7a5cca

blank commit

36ea00e

bajajneha27 changed the title ~~storage(feat): Support bucket encryption config~~ feat(storage): Support bucket encryption config Apr 2, 2026

bajajneha27 requested changes Apr 2, 2026

View reviewed changes

updating tests

88c4b82

shubhangi-google requested a review from bajajneha27 April 2, 2026 11:03

updating doc

0b76c34

bajajneha27 requested changes Apr 6, 2026

View reviewed changes

shubhangi-google added 2 commits April 7, 2026 09:56

updating code

e493d07

updating tests

b4e1f13

shubhangi-google requested a review from bajajneha27 April 7, 2026 12:45

Conversation

shubhangi-google commented Mar 30, 2026

Highlights

Uh oh!

snippet-bot bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bajajneha27 Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

The Fix

How it Works

Comparison of JSON Payloads

Wrong Request (Polluted)

Correct request

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

shubhangi-google Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

snippet-bot bot commented Mar 30, 2026 •

edited

Loading

bajajneha27 Apr 2, 2026 •

edited

Loading

shubhangi-google Apr 6, 2026 •

edited

Loading