Bucket IP filtering lets you restrict access to your Cloud Storage buckets based on client IPv4 or IPv6 address ranges and Virtual Private Cloud (VPC) networks. This network-level control works alongside Identity and Access Management (IAM) permissions to help secure sensitive data and prevent unauthorized access from unapproved networks. ## Benefits Bucket IP filtering for Cloud Storage offers the following benefits: - **Fine-grained access control**: Restrict access to your Cloud Storage buckets based on the specific IP address (IPv4 or IPv6) or VPC network of the requester. Bucket IP filtering adds a network-level access control layer that helps prevent unauthorized access from unknown or untrusted sources. - **Enhanced security**: By limiting access to authorized IP addresses or VPC networks, you can reduce the risk of unauthorized access, data breaches, and malicious activity. - **Flexible configuration**: You can configure and manage lists of IP ranges at the bucket level, tailoring the access control to your specific requirements. ## IP filtering configurations Bucket IP filtering helps you control access to your buckets by defining rules that permit requests from specific IPv4 and IPv6 addresses. Incoming requests are evaluated against these rules to determine access permissions. When you configure IP filtering, you define rules based on the following settings: - **Public internet access**: You can define rules to manage requests originating from the public internet (outside any configured VPC network). These rules specify allowed IPv4 or IPv6 addresses using CIDR ranges, authorizing inbound traffic from those sources. - **VPC access**: For granular control over access from specific VPC networks, you can define rules for each network. These rules include allowed IP ranges, enabling precise management of access from your virtual network infrastructure. - **Service agent access**: Google Cloud service agents retain access to buckets, even with an active IP filtering configuration. You can set up a configuration that allows Google Cloud services such as BigLake, Storage Insights, Vertex AI, and BigQuery to bypass the IP filter validation when accessing your buckets. - **Cross-organization VPC access**: To share data with trusted VPC networks located in different Google Cloud organizations, you can define rules to permit their access to your bucket. ## Limitations Bucket IP filtering has the following limitations: - **Maximum number of IP CIDR blocks**: You can specify a maximum of 200 IP CIDR blocks across public and VPC networks in the IP filter rule for a bucket. - **Maximum number of VPC networks**: You can specify a maximum of 25 VPC networks in the IP filter rules for a bucket. - **Regional endpoints** : [Regional endpoints](https://docs.cloud.google.com/storage/docs/regional-endpoints.md.txt) work with IP filtering only when you use [Private Service Connect](https://docs.cloud.google.com/vpc/docs/private-service-connect.md.txt). - **IPv6 support** : IP filtering with gRPC direct path is not supported on an IPv4 VM. When you use IP filtering with gRPC direct path, you must enable [IPv6 support](https://docs.cloud.google.com/vpc/docs/ipv6-support.md.txt) on the VPC network. - **Cloud Shell** : IP filtering doesn't support Cloud Shell, which uses dynamic IP addresses that you can't predictably add to a bucket's IP filtering rules. To run Google Cloud CLI commands on a bucket with IP filtering enabled, use a [Compute Engine VM](https://docs.cloud.google.com/compute/docs/instances.md.txt) with an allowed static IP address or in an allowed VPC network. - **Blocked Google Cloud services** : Enabling IP filtering on Cloud Storage buckets restricts access for some Google Cloud services, regardless of whether they use a [service agent](https://docs.cloud.google.com/iam/docs/service-agents.md.txt) to interact with Cloud Storage. For example, services such as BigQuery use Cloud Storage for importing and exporting data. To help prevent service disruptions, we recommend not using IP filtering on Cloud Storage buckets accessed by the following services: - BigQuery interactions with Cloud Storage: - [Load data](https://docs.cloud.google.com/bigquery/docs/loading-data-cloud-storage-csv.md.txt) from Cloud Storage to BigQuery. - [Export table data](https://docs.cloud.google.com/bigquery/docs/exporting-data.md.txt) from Cloud Storage to Cloud Storage. - [Export query results](https://docs.cloud.google.com/bigquery/docs/writing-results.md.txt#downloading-saving-results-console) from BigQuery to Cloud Storage. - Query from an [external Cloud Storage table](https://docs.cloud.google.com/bigquery/docs/external-data-cloud-storage.md.txt#query_external_tables) with BigQuery. - If your [App Engine applications access data in Cloud Storage](https://docs.cloud.google.com/appengine/docs/standard/using-cloud-storage.md.txt), we recommend [using App Engine through a VPC network](https://docs.cloud.google.com/appengine/docs/legacy/standard/python/connecting-vpc). > [!CAUTION] > **Caution:** Users and service accounts with administrative roles don't bypass bucket IP filtering rules by default, and neither do requests from Cloud Shell. To help prevent bucket lockouts, we recommend that you grant at least one user or service account a custom role with the `storage.buckets.exemptFromIpFilter` permission so that they can [bypass bucket IP filtering rules](https://docs.cloud.google.com/storage/docs/bypass-ip-filter.md.txt) if needed. ## What's next - [Create IP filtering rules on a bucket](https://docs.cloud.google.com/storage/docs/create-ip-filter.md.txt). - [Update the IP filtering rules on a bucket](https://docs.cloud.google.com/storage/docs/update-ip-filter.md.txt). - [List the IP filtering rules on a bucket](https://docs.cloud.google.com/storage/docs/list-ip-filter.md.txt). - [Disable the IP filtering rules on a bucket](https://docs.cloud.google.com/storage/docs/disable-ip-filtering.md.txt). - [Bypass the IP filtering rules on a bucket](https://docs.cloud.google.com/storage/docs/bypass-ip-filter.md.txt).