Skip to content

Commit 685ddf2

Browse files
thiyaguk09thiyaguk09
authored
Feat(storage): add bucket encryption enforcement (GoogleCloudPlatform#2190)
Adds metadata support for the following encryption enforcement fields: - googleManagedEncryptionEnforcementConfig - customerManagedEncryptionEnforcementConfig - customerSuppliedEncryptionEnforcementConfig * Feat(storage): unify encryption enforcement sample Updates the encryption enforcement sample to a single consolidated file under the `storage_update_encryption_enforcement_config` region tag. The updated sample now covers both partial updates (restriction modes) and the full removal of enforcement configurations. * Feat(storage):add bucket to encryption region tags Updates the region tags to include the 'bucket' keyword for better consistency with other GCS samples: - storage_get_bucket_encryption_enforcement_config - storage_update_bucket_encryption_enforcement_config - storage_set_bucket_encryption_enforcement_config * Refactor(storage): streamline enforcement flow - Refactor `set_bucket_encryption_enforcement_config` to apply enforcement settings during bucket creation instead of a separate update call. - Rename test variable to `$enforcementBucketName` to better align with `BucketEncryptionEnforcementConfig`. - Update PHPUnit test suite to use a dependent data-passing flow for improved reliability and cleaner logic.
1 parent 587a5bc commit 685ddf2

4 files changed

Lines changed: 262 additions & 0 deletions

‎storage/src/get_bucket_encryption_enforcement_config.php‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
<?php
2+
/**
3+
* Copyright 2026 Google Inc.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
/**
19+
* For instructions on how to run the full sample:
20+
*
21+
* @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/storage/README.md
22+
*/
23+
24+
namespace Google\Cloud\Samples\Storage;
25+
26+
# [START storage_get_bucket_encryption_enforcement_config]
27+
use Google\Cloud\Storage\StorageClient;
28+
29+
/**
30+
* Retrieves the current encryption enforcement configurations for a bucket.
31+
*
32+
* @param string $bucketName The ID of your GCS bucket (e.g. "my-bucket").
33+
*/
34+
function get_bucket_encryption_enforcement_config(string $bucketName): void
35+
{
36+
$storage = new StorageClient();
37+
$bucket = $storage->bucket($bucketName);
38+
$metadata = $bucket->info();
39+
40+
printf('Encryption enforcement configuration for bucket %s.' . PHP_EOL, $bucketName);
41+
42+
if (!isset($metadata['encryption'])) {
43+
print('No encryption configuration found (Default GMEK is active).' . PHP_EOL);
44+
return;
45+
}
46+
47+
$enc = $metadata['encryption'];
48+
printf('Default KMS Key: %s' . PHP_EOL, $enc['defaultKmsKeyName'] ?? 'None');
49+
50+
$printConfig = function ($label, $config) {
51+
if ($config) {
52+
printf('%s:' . PHP_EOL, $label);
53+
printf(' Mode: %s' . PHP_EOL, $config['restrictionMode']);
54+
printf(' Effective: %s' . PHP_EOL, $config['effectiveTime'] ?? 'N/A');
55+
}
56+
};
57+
58+
$printConfig('Google Managed (GMEK) Enforcement', $enc['googleManagedEncryptionEnforcementConfig'] ?? null);
59+
$printConfig('Customer Managed (CMEK) Enforcement', $enc['customerManagedEncryptionEnforcementConfig'] ?? null);
60+
$printConfig('Customer Supplied (CSEK) Enforcement', $enc['customerSuppliedEncryptionEnforcementConfig'] ?? null);
61+
}
62+
# [END storage_get_bucket_encryption_enforcement_config]
63+
64+
// The following 2 lines are only needed to run the samples
65+
require_once __DIR__ . '/../../testing/sample_helpers.php';
66+
\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

‎storage/src/set_bucket_encryption_enforcement_config.php‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
<?php
2+
/**
3+
* Copyright 2026 Google Inc.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
/**
19+
* For instructions on how to run the full sample:
20+
*
21+
* @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/storage/README.md
22+
*/
23+
24+
namespace Google\Cloud\Samples\Storage;
25+
26+
# [START storage_set_bucket_encryption_enforcement_config]
27+
use Google\Cloud\Storage\StorageClient;
28+
29+
/**
30+
* Creates a bucket with specific encryption enforcement (e.g., CMEK-only).
31+
*
32+
* @param string $bucketName The ID of your GCS bucket (e.g. "my-bucket").
33+
* @param string $kmsKeyName The name of the KMS key to be used as the default (e.g. "projects/my-project/...").
34+
*/
35+
function set_bucket_encryption_enforcement_config(string $bucketName, string $kmsKeyName): void
36+
{
37+
$storage = new StorageClient();
38+
$bucket = $storage->bucket($bucketName);
39+
40+
// This configuration enforces that all objects uploaded to the bucket
41+
// must use Customer Managed Encryption Keys (CMEK).
42+
$options = [
43+
'encryption' => [
44+
'defaultKmsKeyName' => $kmsKeyName,
45+
'googleManagedEncryptionEnforcementConfig' => [
46+
'restrictionMode' => 'FullyRestricted',
47+
],
48+
'customerSuppliedEncryptionEnforcementConfig' => [
49+
'restrictionMode' => 'FullyRestricted',
50+
],
51+
'customerManagedEncryptionEnforcementConfig' => [
52+
'restrictionMode' => 'NotRestricted',
53+
],
54+
],
55+
];
56+
$storage->createBucket($bucketName, $options);
57+
58+
printf('Bucket %s created with encryption enforcement configuration.' . PHP_EOL, $bucketName);
59+
}
60+
# [END storage_set_bucket_encryption_enforcement_config]
61+
62+
// The following 2 lines are only needed to run the samples
63+
require_once __DIR__ . '/../../testing/sample_helpers.php';
64+
\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

‎storage/src/update_bucket_encryption_enforcement_config.php‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
<?php
2+
/**
3+
* Copyright 2026 Google Inc.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
/**
19+
* For instructions on how to run the full sample:
20+
*
21+
* @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/storage/README.md
22+
*/
23+
24+
namespace Google\Cloud\Samples\Storage;
25+
26+
# [START storage_update_bucket_encryption_enforcement_config]
27+
use Google\Cloud\Storage\StorageClient;
28+
29+
/**
30+
* Updates or removes encryption enforcement configurations from a bucket.
31+
*
32+
* @param string $bucketName The ID of your GCS bucket (e.g. "my-bucket").
33+
*/
34+
function update_bucket_encryption_enforcement_config(string $bucketName): void
35+
{
36+
$storage = new StorageClient();
37+
$bucket = $storage->bucket($bucketName);
38+
39+
// Update a specific encryption type's restriction mode
40+
// This partial update preserves other existing encryption settings.
41+
$updateOptions = [
42+
'encryption' => [
43+
'googleManagedEncryptionEnforcementConfig' => [
44+
'restrictionMode' => 'FullyRestricted'
45+
]
46+
]
47+
];
48+
$bucket->update($updateOptions);
49+
printf('Google-managed encryption enforcement set to FullyRestricted for %s.' . PHP_EOL, $bucketName);
50+
51+
// Remove all encryption enforcement configurations altogether
52+
// Setting these values to null removes the policies from the bucket metadata.
53+
$clearOptions = [
54+
'encryption' => [
55+
'defaultKmsKeyName' => null,
56+
'googleManagedEncryptionEnforcementConfig' => null,
57+
'customerSuppliedEncryptionEnforcementConfig' => null,
58+
'customerManagedEncryptionEnforcementConfig' => null,
59+
],
60+
];
61+
62+
$bucket->update($clearOptions);
63+
printf('All encryption enforcement configurations removed from bucket %s.' . PHP_EOL, $bucketName);
64+
}
65+
# [END storage_update_bucket_encryption_enforcement_config]
66+
67+
// The following 2 lines are only needed to run the samples
68+
require_once __DIR__ . '/../../testing/sample_helpers.php';
69+
\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

‎storage/test/storageTest.php‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -573,6 +573,69 @@ public function testObjectGetKmsKey(string $objectName)
573573
);
574574
}
575575

576+
public function testSetBucketEncryptionEnforcementConfig()
577+
{
578+
$enforcementBucketName = self::$bucketName . '-enc-enforcement';
579+
580+
$output = $this->runFunctionSnippet('set_bucket_encryption_enforcement_config', [
581+
$enforcementBucketName,
582+
$this->keyName(),
583+
]);
584+
585+
$this->assertEquals($output, sprintf(
586+
'Bucket %s created with encryption enforcement configuration.' . PHP_EOL,
587+
$enforcementBucketName
588+
));
589+
}
590+
591+
/** @depends testSetBucketEncryptionEnforcementConfig */
592+
public function testGetBucketEncryptionEnforcementConfig()
593+
{
594+
$enforcementBucketName = self::$bucketName . '-enc-enforcement';
595+
596+
sleep(2);
597+
$output = $this->runFunctionSnippet('get_bucket_encryption_enforcement_config', [
598+
$enforcementBucketName
599+
]);
600+
601+
$this->assertStringContainsString(
602+
sprintf('Encryption enforcement configuration for bucket %s.', $enforcementBucketName),
603+
$output
604+
);
605+
$this->assertStringContainsString(sprintf('Default KMS Key: %s', $this->keyName()), $output);
606+
$this->assertStringContainsString('Google Managed (GMEK) Enforcement:' . PHP_EOL . ' Mode: FullyRestricted', $output);
607+
$this->assertStringContainsString('Customer Supplied (CSEK) Enforcement:' . PHP_EOL . ' Mode: FullyRestricted', $output);
608+
$this->assertStringContainsString('Customer Managed (CMEK) Enforcement:' . PHP_EOL . ' Mode: NotRestricted', $output);
609+
}
610+
611+
/** @depends testGetBucketEncryptionEnforcementConfig */
612+
public function testUpdateBucketEncryptionEnforcementConfig()
613+
{
614+
$enforcementBucketName = self::$bucketName . '-enc-enforcement';
615+
616+
$output = $this->runFunctionSnippet('update_bucket_encryption_enforcement_config', [
617+
$enforcementBucketName
618+
]);
619+
620+
$this->assertStringContainsString(
621+
sprintf('Google-managed encryption enforcement set to FullyRestricted for %s.', $enforcementBucketName),
622+
$output
623+
);
624+
625+
$this->assertStringContainsString(
626+
sprintf('All encryption enforcement configurations removed from bucket %s.', $enforcementBucketName),
627+
$output
628+
);
629+
630+
// Final verification: Ensure 'Get' now shows no configuration
631+
sleep(2);
632+
$finalOutput = $this->runFunctionSnippet('get_bucket_encryption_enforcement_config', [
633+
$enforcementBucketName
634+
]);
635+
636+
$this->assertStringContainsString('No encryption configuration found (Default GMEK is active).', $finalOutput);
637+
}
638+
576639
public function testBucketVersioning()
577640
{
578641
$output = self::runFunctionSnippet('enable_versioning', [

0 commit comments

Comments
 (0)