Cloud Storage Bucket Exposure Audit

Check who can read and write stored files.

Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it (what [VERIFY] means).

Audit cloud storage permissions. List of storage containers with purpose, public or private status, policies and sharing links, with names changed: [STORAGE_LIST]. Data stored: [DATA_TYPES]. Who administers access: [ADMINS].

Check public access, overly broad policies, shared links without expiry, versioning, encryption, logging, retention and orphaned containers. Explain each risk in plain language.

Return a table with Container, Exposure, Data sensitivity, Risk (red, amber, green) and Fix, a safe remediation order that avoids breaking applications, and a monitoring plan. Breach duties are [VERIFY] for [JURISDICTION].

Also suggest how to test that a container is private from outside the organisation using an ordinary account, and how to review access logs for unusual downloads. Finish with the container to fix first.

Finish with a one-sentence summary of the exposure level for the owner of the data.

Then develop a secure storage standard for the organisation. Write ten rules on naming, ownership, default privacy, sharing links, encryption, versioning, logging, lifecycle and deletion. Provide a pre-launch checklist for any new storage location and a quarterly review procedure with a report template. Describe how to test from outside the organisation that a container is private, using an ordinary account and no special tools, and how to record the result. Suggest a safe remediation plan for exposed data: restrict access, preserve logs, assess what was accessed, involve the data owner, and decide on notification with the right advisers. Add a section on training for people who create storage, and a way to detect new public containers quickly. Notification duties and regulatory requirements are [VERIFY] for [JURISDICTION], and a security professional should verify configuration changes.

Add a final note on documenting what was found, what was changed and who approved it, so that an auditor or insurer could follow the record without further explanation.

Suggest detection and prevention measures only. Where a finding touches regulatory duties such as breach notification, tag it [VERIFY] for [JURISDICTION] and tell me to involve the responsible officer.

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.

Container list (invented names)
media-public: public read by design (images). Data sensitivity low. Green; add lifecycle rule.
backup-2021: public read enabled by mistake; contains database exports. Risk red. Fix first: restrict access, review logs for downloads, tell the data owner.
reports-share: sharing link with no expiry, sent to 14 people. Amber.
dev-tests: private; versioning off. Green.
Order of remediation: restrict backup-2021, expire links, then enable logging on all containers. Check applications that rely on public access before changing. Breach duties: [VERIFY].

• audit