[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers) (requires [organization-level activation](/security-command-center/docs/activate-scc-overview#overview_of_organization-level_activation))\n\nThis page describes the preventative and detective policies that are included in\nthe v1.0 version of the predefined posture for Cloud Storage, extended. This posture\nincludes two policy sets:\n\n- A policy set that includes organization policies that apply to\n Cloud Storage.\n\n- A policy set that includes Security Health Analytics detectors that apply to\n Cloud Storage.\n\nYou can use this predefined posture to configure a security posture that helps\nprotect Cloud Storage. If you want to deploy this predefined posture, you\nmust customize some of the policies so that they apply to your environment.\n\nOrganization policy constraints\n\nThe following table describes the organization policies that are included in\nthis posture.\n\n| Policy | Description | Compliance standard |\n|------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------|\n| `storage.publicAccessPrevention` | This policy prevents Cloud Storage buckets from being open to unauthenticated public access. The value is `true` to prevent public access to buckets. | NIST SP 800-53 control: AC-3, AC-17, and AC-20 |\n| `storage.uniformBucketLevelAccess` | This policy prevents Cloud Storage buckets from using per-object ACL (a separate system from IAM policies) to provide access, enforcing consistency for access management and auditing. The value is `true` to enforce [uniform bucket-level access](/storage/docs/uniform-bucket-level-access). | NIST SP 800-53 control: AC-3, AC-17, and AC-20 |\n| `storage.retentionPolicySeconds` | This constraint defines the duration (in seconds) for the retention policy for buckets. You must configure this value when you adopt this predefined posture. | NIST SP 800-53 control: SI-12 |\n\nSecurity Health Analytics detectors\n\nThe following table describes the Security Health Analytics detectors that are included in\nthe predefined posture. For more information about these detectors, see\n[Vulnerability findings](/security-command-center/docs/concepts-vulnerabilities-findings).\n\n| Detector name | Description |\n|-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------|\n| `BUCKET_LOGGING_DISABLED` | This detector checks whether there is a storage bucket without logging enabled. |\n| `LOCKED_RETENTION_POLICY_NOT_SET` | This detector checks whether the locked retention policy is set for logs. |\n| `OBJECT_VERSIONING_DISABLED` | This detector checks whether object versioning is enabled on storage buckets with sinks. |\n| `BUCKET_CMEK_DISABLED` | This detector checks whether buckets are encrypted using customer-managed encryption keys (CMEK). |\n| `BUCKET_POLICY_ONLY_DISABLED` | This detector checks whether uniform bucket-level access is configured. |\n| `PUBLIC_BUCKET_ACL` | This detector checks whether a bucket is publicly accessible. |\n| `PUBLIC_LOG_BUCKET` | This detector checks whether a bucket with a log sink is publicly accessible. |\n| `ORG_POLICY_LOCATION_RESTRICTION` | This detector checks whether a Compute Engine resource is out of compliance with the `constraints/gcp.resourceLocations` constraint. |\n\nView the posture template\n\n\nTo view the posture template for Cloud Storage, extended, do the following: \n\ngcloud\n\n\nBefore using any of the command data below,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: the numeric ID of the organization\n\n\nExecute the\n\n\n[`gcloud scc posture-templates\ndescribe`](/sdk/gcloud/reference/scc/posture-templates/describe)\n\n\ncommand:\n\nLinux, macOS, or Cloud Shell \n\n```bash\ngcloud scc posture-templates describe \\\n organizations/ORGANIZATION_ID/locations/global/postureTemplates/cloud_storage_extended\n```\n\nWindows (PowerShell) \n\n```bash\ngcloud scc posture-templates describe `\n organizations/ORGANIZATION_ID/locations/global/postureTemplates/cloud_storage_extended\n```\n\nWindows (cmd.exe) \n\n```bash\ngcloud scc posture-templates describe ^\n organizations/ORGANIZATION_ID/locations/global/postureTemplates/cloud_storage_extended\n```\n\nThe response contains the posture template.\n\nREST\n\n\nBefore using any of the request data,\nmake the following replacements:\n\n- \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: the numeric ID of the organization\n\n\nHTTP method and URL:\n\n```\nGET https://securityposture.googleapis.com/v1/organizations/ORGANIZATION_ID/locations/global/postureTemplates/cloud_storage_extended\n```\n\nTo send your request, expand one of these options:\n\ncurl (Linux, macOS, or Cloud Shell) **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](/sdk/gcloud/reference/init) or [`gcloud auth login`](/sdk/gcloud/reference/auth/login) , or by using [Cloud Shell](/shell/docs), which automatically logs you into the `gcloud` CLI . You can check the currently active account by running [`gcloud auth list`](/sdk/gcloud/reference/auth/list).\n\n\nExecute the following command:\n\n```\ncurl -X GET \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n \"https://securityposture.googleapis.com/v1/organizations/ORGANIZATION_ID/locations/global/postureTemplates/cloud_storage_extended\"\n```\n\nPowerShell (Windows) **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](/sdk/gcloud/reference/init) or [`gcloud auth login`](/sdk/gcloud/reference/auth/login) . You can check the currently active account by running [`gcloud auth list`](/sdk/gcloud/reference/auth/list).\n\n\nExecute the following command:\n\n```\n$cred = gcloud auth print-access-token\n$headers = @{ \"Authorization\" = \"Bearer $cred\" }\n\nInvoke-WebRequest `\n -Method GET `\n -Headers $headers `\n -Uri \"https://securityposture.googleapis.com/v1/organizations/ORGANIZATION_ID/locations/global/postureTemplates/cloud_storage_extended\" | Select-Object -Expand Content\n```\n\nThe response contains the posture template.\n\nWhat's next\n\n- [Create a security posture using this predefined posture](/security-command-center/docs/how-to-use-security-posture)."]]
