You can view the IP filtering rules on a Cloud Storage bucket when you want
to audit which IP addresses and CIDR ranges can access your data. Inspecting
these rules helps you verify your network access controls and confirm that only
authorized traffic reaches your bucket.

For background information, see [Bucket IP filtering](https://docs.cloud.google.com/storage/docs/ip-filtering-overview.md.txt).

## Required roles

To get the required permissions for getting the IP filtering rules on a bucket, ask your administrator to grant you the Storage Admin (`roles/storage.admin`)
role on the bucket. This role contains the permissions required to get bucket IP filtering rules.

To see the exact permissions that are required, expand the
**Required permissions** section:

#### Required permissions

- `storage.buckets.get`
- `storage.buckets.getIpFilter`

You can also get these permissions with [custom roles](https://docs.cloud.google.com/iam/docs/creating-custom-roles.md.txt). You might be able to get these permissions with other predefined roles as well. To see which roles are associated with which permissions,
refer to [IAM roles for Cloud Storage](https://docs.cloud.google.com/iam/docs/understanding-roles).

For instructions on granting roles for projects, see [Manage access to
projects](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access).

## Get bucket IP filtering rules

### Console

To view IP filtering rules in the Google Cloud console, follow the instructions in [List bucket IP filtering rules](https://docs.cloud.google.com/storage/docs/list-ip-filter.md.txt#console).
The Google Cloud console displays all configured IP ranges and settings on a single page.

### gcloud

1. To get the IP filtering rules on a bucket, run the command [`gcloud
   storage buckets describe`](https://docs.cloud.google.com/sdk/gcloud/reference/storage/buckets/describe) in your development
   environment:

   ```
   gcloud storage buckets describe gs://BUCKET_NAME --format="default(ip_filter_config)"
   ```

   Where:

   `BUCKET_NAME` is the name of your bucket. For example, `my-bucket`.

### JSON API

1. Have gcloud CLI [installed and initialized](https://docs.cloud.google.com/sdk/docs/install), which lets
   you generate an access token for the `Authorization` header.

2. Use [`cURL`](http://curl.haxx.se/) to call the [JSON API](https://docs.cloud.google.com/storage/docs/json_api.md.txt) with a [`GET` bucket](https://docs.cloud.google.com/storage/docs/json_api/v1/buckets/get.md.txt) request:

   ```
   curl -X GET \
       -H "Authorization: Bearer $(gcloud auth print-access-token)" \
       "https://storage.googleapis.com/storage/v1/b/BUCKET_NAME"
   ```

   Where:

   `BUCKET_NAME` is the name of your bucket. For example, `my-bucket`.

## What's next

- [Create or update IP filtering rules on an existing bucket](https://docs.cloud.google.com/storage/docs/update-ip-filter.md.txt).
- [List bucket IP filtering rules](https://docs.cloud.google.com/storage/docs/list-ip-filter.md.txt).
- [Disable bucket IP filtering rules](https://docs.cloud.google.com/storage/docs/disable-ip-filtering.md.txt).