Description

Ensure that Cloud Storage buckets have the Soft Delete feature enabled with an appropriate retention duration, so that deleted or overwritten objects can be recovered within a defined window instead of being immediately and permanently removed.

Rationale

Without soft delete, an accidental deletion, an overwrite, or a malicious deletion (for example, from a compromised credential or ransomware-style attack) permanently removes object data with no recovery path unless Object Versioning happens to preserve prior versions. Soft delete retains the previous state of an object for a configurable period after deletion or overwrite, providing a safety net for accidental or malicious data loss.

Impact

  • Allows recovery of accidentally or maliciously deleted or overwritten objects within the retention window

  • Provides protection against ransomware-style mass deletion of bucket contents

  • Increases storage cost, since soft-deleted object data is retained and billed during the retention window

Default Value

Soft delete is enabled by default with a 7-day retention duration for buckets created after the feature's general availability; existing buckets created earlier may not have it enabled and should be verified.

Pre-Requisites

  • IAM permissions to view and edit Cloud Storage bucket configuration (e.g., Storage Admin)

  • Awareness of the additional storage cost associated with the soft delete retention window

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Cloud Storage > Buckets and select the bucket to review.

  4. Open the Protection tab.

  5. Verify that Soft delete policy shows as Enabled with a retention duration appropriate for the organization's recovery requirements.

  6. If soft delete is disabled or set to a 0-day duration, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Cloud Storage > Buckets and select the bucket to update.

  4. Open the Protection tab.

  5. Locate Soft delete policy and select Edit.

  6. Set the retention duration to the desired number of days (for example, 7 days) and confirm the change.

  7. Verify the Protection tab now reflects the updated soft delete configuration.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Cloud Storage > Buckets and select the affected bucket.

  4. Open the Protection tab and select Edit next to Soft delete policy.

  5. Set the retention duration to 0 days to disable soft delete.

  6. Confirm the change.

Reference