Bypass bucket IP filtering rules

You can allow users or service accounts to perform certain operations on buckets without any IP filtering restrictions, while still enforcing restrictions for other operations. To do this, you bypass IP filtering rules.

You need a way to regain access to your bucket if you inadvertently block your own access, because administrative roles don't bypass bucket IP filtering rules by default. You might lose access to your bucket for the following reasons:

  • Misconfigured IP rules: You accidentally add a rule that blocks your own IP address or the IP range of your network.

  • Unexpected IP change: Your IP address changes unexpectedly due to network changes.

  • Cloud Shell usage: You rely on Cloud Shell to manage your bucket, but Cloud Shell uses dynamic IP addresses that you can't predictably add to a bucket's IP filtering rules. To run Google Cloud CLI commands on a bucket with IP filtering enabled, use a Compute Engine VM with an allowed static IP address or in an allowed Virtual Private Cloud (VPC) network.

For background information about bucket IP filtering, see Bucket IP filtering.

Supported operations

When you bypass IP filtering, the following operations are exempt from IP filtering restrictions:

Bypass bucket IP filtering rules

To enable specific users or service accounts to bypass IP filtering restrictions on a bucket, grant them the storage.buckets.exemptFromIpFilter permission using a custom role. This permission exempts the user or service account from IP filtering rules for supported bucket-level operations. To do so, complete the following steps:

  1. Identify the user or service account that needs to bypass the IP filtering restrictions on specific buckets.

  2. Create a custom role.

  3. Add the storage.buckets.exemptFromIpFilter permission to the role.

  4. Grant the custom role to the identified user or service account at the project level. For information about granting roles, see Grant a single role.

After you grant the users or service accounts these permissions, they can perform supported operations without any IP filtering restrictions. Requiring explicit permissions helps ensure that bypassing IP filtering rules is a deliberate and authorized action by providing granular control over the exceptions to the rules.

Bypass IP filtering rules for Google Cloud service agents

You can let Google Cloud service agents bypass IP filtering rules for your bucket. The service agent and the bucket must be in the same project.

When enabled, services such as Compute Engine or Cloud Run within the bucket's project can access the bucket freely, regardless of their IP addresses. Service agents from different projects can't use this bypass. If you need to grant access to services in other projects while maintaining IP-based restrictions, consider using features like VPC Service Controls or IAM conditions.

For information about how to allow Google Cloud service agents to access your bucket, see Manage service agent access.

Bypass IP filtering rules for cross-organization VPC networks

You can let resources from a different organization's VPC network access the bucket without restrictions from your existing IP filtering configuration. For information about how to allow cross-organization VPC networks to access your bucket, see Manage cross-organization VPC access.

What's next