# Ensure Object Storage bucket is not publicly accessible

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698521720152-ensure-object-storage-bucket-is-not-publicly-accessible
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure every Object Storage bucket has its visibility set to Private, so that objects can only be read by authenticated users with the right IAM permissions or through pre-authenticated requests. Public visibility should only be used for content that is intentionally meant for everyone.

**Rationale**

A public bucket lets anyone on the internet list and download its objects without signing in. Sensitive files placed in a public bucket by mistake can be found and copied within hours. Keeping buckets private and sharing specific objects with time-limited pre-authenticated requests prevents unintended data exposure.

**Impact**

-   Objects can only be accessed by authorized users
    
-   Prevents accidental exposure of sensitive data
    
-   Public websites or apps using the bucket need pre-authenticated requests or another solution
    

**Default Value**

By default, new buckets are created with Private visibility.

**Pre-Requisites**

-   Permission to manage buckets in the compartment
    
-   A list of buckets that must stay public, with a documented reason
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.
    
3.  Select the Bucket information tab and check the Visibility value.
    
4.  If it shows Public without a documented reason, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.
    
3.  Select Edit visibility.
    
4.  Select Private and select Save changes.
    
5.  For users or apps that need access, use IAM policies or create pre-authenticated requests with an expiry date.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.
    
3.  Select Edit visibility, select Public, and select Save changes.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Object/Tasks/managingbuckets.htm](https://docs.oracle.com/en-us/iaas/Content/Object/Tasks/managingbuckets.htm)
    
-   [https://docs.oracle.com/en-us/iaas/Content/Object/Tasks/usingpreauthenticatedrequests.htm](https://docs.oracle.com/en-us/iaas/Content/Object/Tasks/usingpreauthenticatedrequests.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.