You can allow users or service accounts to perform certain
operations on buckets without any IP filtering restrictions, while still
enforcing restrictions for other operations. To do this, you bypass IP filtering
rules.

You need a way to regain access to your bucket if you inadvertently block your
own access, because administrative roles don't bypass bucket IP filtering rules
by default. You might lose access to your bucket for the following reasons:

- **Misconfigured IP rules**: You accidentally add a rule that blocks your own
  IP address or the IP range of your network.

- **Unexpected IP change**: Your IP address changes unexpectedly due to network
  changes.

- **Cloud Shell usage** : You rely on Cloud Shell to manage your
  bucket, but Cloud Shell uses dynamic IP addresses that you can't
  predictably add to a bucket's IP filtering rules. To run Google Cloud CLI
  commands on a bucket with IP filtering enabled, use a
  [Compute Engine VM](https://docs.cloud.google.com/compute/docs/instances.md.txt) with an allowed static IP address or in an allowed
  Virtual Private Cloud (VPC) network.

For background information about bucket IP filtering, see [Bucket IP filtering](https://docs.cloud.google.com/storage/docs/ip-filtering-overview.md.txt).

## Supported operations

When you bypass IP filtering, the following operations are exempt from IP
filtering restrictions:

- Getting a bucket's metadata ([`GET` Bucket](https://docs.cloud.google.com/storage/docs/json_api/v1/buckets/get.md.txt))
- Updating a bucket ([`PATCH` Bucket](https://docs.cloud.google.com/storage/docs/json_api/v1/buckets/patch.md.txt))
- Deleting a bucket ([`DELETE` Bucket](https://docs.cloud.google.com/storage/docs/json_api/v1/buckets/delete.md.txt))

## Bypass bucket IP filtering rules

To enable specific users or service accounts to bypass IP filtering restrictions
on a bucket, grant them the `storage.buckets.exemptFromIpFilter` permission
using a custom role. This permission exempts the user or service account from IP
filtering rules for supported bucket-level operations. To do so, complete the
following steps:

1. Identify the user or service account that needs to bypass the IP filtering
   restrictions on specific buckets.

2. Create a [custom role](https://docs.cloud.google.com/iam/docs/creating-custom-roles.md.txt).

3. Add the `storage.buckets.exemptFromIpFilter` permission to the role.

4. Grant the custom role to the identified user or service account at the
   project level. For information about granting roles, see [Grant a single role](https://docs.cloud.google.com/iam/docs/manage-access-service-accounts.md.txt#grant-single-role).

After you grant the users or service accounts these permissions, they can
perform supported operations without any IP filtering restrictions. Requiring
explicit permissions helps ensure that bypassing IP filtering rules is a
deliberate and authorized action by providing granular control over the
exceptions to the rules.

## Bypass IP filtering rules for Google Cloud service agents

You can let Google Cloud service agents bypass IP filtering rules for your
bucket. The service agent and the bucket must be in the same project.

When enabled, services such as Compute Engine or Cloud Run within the
bucket's project can access the bucket freely, regardless of their IP addresses.
Service agents from different projects can't use this bypass.
If you need to grant access to services in other projects while maintaining
IP-based restrictions, consider using features like [VPC Service Controls](https://docs.cloud.google.com/vpc-service-controls/docs/overview.md.txt) or
[IAM](https://docs.cloud.google.com/iam/docs/overview.md.txt) conditions.

For information about how to allow Google Cloud service agents to access your
bucket, see [Manage service agent access](https://docs.cloud.google.com/storage/docs/update-ip-filter.md.txt#manage-service-agent-access).

## Bypass IP filtering rules for cross-organization VPC networks

You can let resources from a different organization's VPC network
access the bucket without restrictions from your existing IP filtering
configuration. For information about how to allow cross-organization
VPC networks to access your bucket, see [Manage
cross-organization VPC access](https://docs.cloud.google.com/storage/docs/update-ip-filter#manage-vpc-access).

## What's next

- [Disable IP filtering rules on a bucket](https://docs.cloud.google.com/storage/docs/disable-ip-filtering.md.txt).
- [Get IP filtering rules on a bucket](https://docs.cloud.google.com/storage/docs/get-ip-filter.md.txt).
- [List bucket IP filtering rules](https://docs.cloud.google.com/storage/docs/list-ip-filter.md.txt).