8

I've been using project-id as a prefix in my GCS bucket-names to easily get a unique name. When I read GCS-best practises

It says clearly not to use project-names or project-numbers (nothing about projectId:s) But on the other hand, when I spin up GAE, two buckets containing the project-id are automatically created.

Is Google not following their own best practices or did I miss something?

Are the greatest risk of having projectId in bucket name that I give clues to a potential attacker about the project since bucket-names are publicly visible?

Calle Engene
  • 717
  • 11
  • 24

2 Answers2

6

It does appear, to some degree, that Google might not be following its best practices (as listed on that page, assuming that project names and numbers mean GCP names and numbers). The default bucket for Firebase projects layered on top of GCP does the same.

The documentation you linked states the reason to avoid using project names:

... because anyone can probe for the existence of a bucket ...

The idea is that if someone knows the name of your project, they could use that to build the full name of the bucket, and use that knowledge in an attack in order to gain its contents. However, if your security configuration is exactly what it should be, then knowing the name of the bucket won't be a problem. This is particularly true for Firebase projects, which use security rules to determine who should be able to access what objects.

I'd take the advice in the documentation as a measure of security through obscurity in order to prevent attackers from guessing the names of your buckets and any of its contents. But if that's not your concern, then ignore it.

Doug Stevenson
  • 297,357
  • 32
  • 422
  • 441
  • We use projectIDs in combination with our top level domain, where we verified ownership at say `mydomain.com` and then are able to programmatically create globally unique bucket names, say `project-id-1.mydomain.com`, `project-id-2.mydomain.com`, etc. 'probing for the existence of a bucket' is slightly harder this way. – Jan Krynauw Aug 06 '21 at 08:49
3

It looks like they're just worried about leaking PII. I'm not sure why they mentioned project names, unless it's because someone might include PII in their project name.

Don't use user IDs, email addresses, project names, project numbers, or any personally identifiable information (PII) in bucket names because anyone can probe for the existence of a bucket. Similarly, be very careful with putting PII in your object names, because object names appear in URLs for the object.

The two buckets I see created in my account have an appspot.com suffix. You cannot create arbitrary appspot.com buckets because they have a . in the name and thus are subject to verification:

Bucket names must contain only lowercase letters, numbers, dashes (-), underscores (_), and dots (.). Spaces are not allowed. Names containing dots require verification.

You are right though that the automatic bucket creation is inconsistent with their best practice guidelines.

Doug Richardson
  • 10,483
  • 6
  • 51
  • 77
  • 1
    Yes, PII concerns are the reason Google recommends not using project IDs in bucket names. If your project IDs don't contain anything confidential or otherwise problematic to have visible in bucket names, this advice may not apply to you. – Mike Schwartz Dec 10 '19 at 16:58