This page describes how to use the Bucket Lock feature, including working with retention policies and permanently locking them on buckets.
Before you begin
Before you can use the Bucket Lock feature, make sure the steps in the following sections have been completed.
Get required roles
To get the permissions that you need to use Bucket Lock, ask your
administrator to grant you the Storage Admin (roles/storage.admin) role on the
bucket. This predefined role contains the permissions required to use
Bucket Lock. To see the exact permissions required, expand the
Required permissions section:
Required permissions
storage.buckets.getstorage.buckets.list- This permission is only required if you plan on using the Google Cloud console to perform the instructions on this page.
storage.buckets.update
You might also be able to get these permissions with custom roles.
For information about granting roles on buckets, see Set and manage IAM policies on buckets.
Set a retention policy on a bucket
To add, modify, or remove a retention policy on a bucket:
Console
- In the Google Cloud console, go to the Cloud Storage Buckets page.
In the list of buckets, click the name of the bucket whose retention policy you want to change.
Select the Protection tab near the top of the page.
In the Retention policy section, set your retention policy:
If no retention policy currently applies to the bucket, click the add_box Set Retention Policy link. Choose a unit of time and a length of time for your retention period.
If a retention policy currently applies to a bucket, it appears in the section. Click Edit to modify the retention time or Delete to remove the retention policy entirely.
See Retention periods for information about how the Google Cloud console converts between different units of time.
To learn how to get detailed error information about failed Cloud Storage operations in the Google Cloud console, see Troubleshooting.
Command line
Use the gcloud storage buckets update command with the
appropriate flag:
gcloud storage buckets update gs://BUCKET_NAME FLAG
Where:
BUCKET_NAMEis the name of the relevant bucket. For example,my-bucket.FLAGis the desired setting for the bucket's retention period. Use one of the following formats:--retention-periodand a retention period, if you want to add or change a retention policy. For example,--retention-period=1d43200s.--clear-retention-period, if you want to remove the retention policy on the bucket.
If successful, the response looks like:
Updating gs://my-bucket/... Completed 1
Client libraries
For more information, see the
Cloud Storage C++ API
reference documentation.
To authenticate to Cloud Storage, set up Application Default Credentials.
For more information, see
Set up authentication for client libraries.
The following sample sets a retention policy on a bucket: The following sample removes the retention policy from a bucket:
For more information, see the
Cloud Storage C# API
reference documentation.
To authenticate to Cloud Storage, set up Application Default Credentials.
For more information, see
Set up authentication for client libraries.
The following sample sets a retention policy on a bucket: The following sample removes the retention policy from a bucket:
For more information, see the
Cloud Storage Go API
reference documentation.
To authenticate to Cloud Storage, set up Application Default Credentials.
For more information, see
Set up authentication for client libraries.
The following sample sets a retention policy on a bucket: The following sample removes the retention policy from a bucket:
For more information, see the
Cloud Storage Java API
reference documentation.
To authenticate to Cloud Storage, set up Application Default Credentials.
For more information, see
Set up authentication for client libraries.
The following sample sets a retention policy on a bucket: The following sample removes the retention policy from a bucket:
For more information, see the
Cloud Storage Node.js API
reference documentation.
To authenticate to Cloud Storage, set up Application Default Credentials.
For more information, see
Set up authentication for client libraries.
The following sample sets a retention policy on a bucket: The following sample removes the retention policy from a bucket:C++
C#
Go
Java
Node.js