Skip to content

Commit b375f88

Browse files
mahendra-googlemahendra-google
committed
samples(Storage): Add samples and tests for bucket encryption enforcement configuration (b/465329369)
1 parent 4f7c4ae commit b375f88

6 files changed

+363
-0
lines changed

‎storage/api/Storage.Samples.Tests/BucketGetEncryptionEnforcementConfigTest.cs‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
// Copyright 2026 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using Xunit;
16+
17+
[Collection(nameof(StorageFixture))]
18+
public class BucketGetEncryptionEnforcementConfigTest
19+
{
20+
private readonly StorageFixture _fixture;
21+
22+
public BucketGetEncryptionEnforcementConfigTest(StorageFixture fixture)
23+
{
24+
_fixture = fixture;
25+
}
26+
27+
[Fact]
28+
public void BucketGetEncryptionEnforcementConfig()
29+
{
30+
var bucketSetEncConfigSample = new BucketSetEncryptionEnforcementConfigSample();
31+
var bucketGetEncConfigSample = new BucketGetEncryptionEnforcementConfigSample();
32+
var bucketName = _fixture.GenerateBucketName();
33+
_fixture.CreateBucket(bucketName: bucketName, location: _fixture.KmsKeyLocation);
34+
35+
string keyName = $"projects/{_fixture.ProjectId}/locations/{_fixture.KmsKeyLocation}/keyRings/{_fixture.KmsKeyRing}/cryptoKeys/{_fixture.KmsKeyName}";
36+
var bucket = bucketSetEncConfigSample.SetBucketEncryptionEnforcementConfig(
37+
bucketName: bucketName,
38+
kmsKeyName: keyName,
39+
enforceCmek: true);
40+
var bucketEncryptionData = bucketGetEncConfigSample.BucketGetEncryptionEnforcementConfig(bucket.Name);
41+
Assert.NotNull(bucketEncryptionData);
42+
Assert.Equal(keyName, bucketEncryptionData.DefaultKmsKeyName);
43+
Assert.Multiple(() =>
44+
{
45+
Assert.Equal("NotRestricted", bucketEncryptionData.CustomerManagedEncryptionEnforcementConfig?.RestrictionMode);
46+
Assert.Equal("FullyRestricted", bucketEncryptionData.CustomerSuppliedEncryptionEnforcementConfig?.RestrictionMode);
47+
Assert.Equal("FullyRestricted", bucketEncryptionData.GoogleManagedEncryptionEnforcementConfig?.RestrictionMode);
48+
});
49+
}
50+
}

‎storage/api/Storage.Samples.Tests/BucketRemoveAllEncryptionEnforcementConfigTest.cs‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
// Copyright 2026 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using Xunit;
16+
17+
[Collection(nameof(StorageFixture))]
18+
public class BucketRemoveAllEncryptionEnforcementConfigTest
19+
{
20+
private readonly StorageFixture _fixture;
21+
22+
public BucketRemoveAllEncryptionEnforcementConfigTest(StorageFixture fixture)
23+
{
24+
_fixture = fixture;
25+
}
26+
27+
[Fact]
28+
public void BucketRemoveAllEncryptionEnforcementConfig()
29+
{
30+
var bucketSetEncConfigSample = new BucketSetEncryptionEnforcementConfigSample();
31+
var bucketRemoveEncConfigSample = new BucketRemoveAllEncryptionEnforcementConfigSample();
32+
var bucketName = _fixture.GenerateBucketName();
33+
_fixture.CreateBucket(bucketName: bucketName, location: _fixture.KmsKeyLocation);
34+
string keyName = $"projects/{_fixture.ProjectId}/locations/{_fixture.KmsKeyLocation}/keyRings/{_fixture.KmsKeyRing}/cryptoKeys/{_fixture.KmsKeyName}";
35+
var bucket = bucketSetEncConfigSample.SetBucketEncryptionEnforcementConfig(
36+
bucketName: bucketName,
37+
kmsKeyName: keyName,
38+
enforceCmek: true);
39+
var updatedBucket = bucketRemoveEncConfigSample.BucketRemoveAllEncryptionEnforcementConfig(bucket.Name);
40+
Assert.Equal(updatedBucket.Encryption.DefaultKmsKeyName, bucket.Encryption.DefaultKmsKeyName);
41+
Assert.Multiple(() =>
42+
{
43+
Assert.Null(updatedBucket.Encryption.CustomerSuppliedEncryptionEnforcementConfig);
44+
Assert.Null(updatedBucket.Encryption.CustomerManagedEncryptionEnforcementConfig);
45+
Assert.Null(updatedBucket.Encryption.GoogleManagedEncryptionEnforcementConfig);
46+
});
47+
}
48+
}

‎storage/api/Storage.Samples.Tests/BucketSetEncryptionEnforcementConfigTest.cs‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
// Copyright 2026 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
using Xunit;
16+
17+
[Collection(nameof(StorageFixture))]
18+
public class BucketSetEncryptionEnforcementConfigTest
19+
{
20+
private readonly StorageFixture _fixture;
21+
22+
public BucketSetEncryptionEnforcementConfigTest(StorageFixture fixture)
23+
{
24+
_fixture = fixture;
25+
}
26+
27+
[Theory]
28+
[InlineData(true, false, false)]
29+
[InlineData(false, true, false)]
30+
[InlineData(false, false, true)]
31+
public void BucketSetEncryptionEnforcementConfig(
32+
bool enforceCmek,
33+
bool enforceGmek,
34+
bool restrictCsek)
35+
{
36+
var bucketSetEncConfigSample = new BucketSetEncryptionEnforcementConfigSample();
37+
var bucketName = _fixture.GenerateBucketName();
38+
string keyName = enforceCmek
39+
? $"projects/{_fixture.ProjectId}/locations/{_fixture.KmsKeyLocation}/keyRings/{_fixture.KmsKeyRing}/cryptoKeys/{_fixture.KmsKeyName}"
40+
: null;
41+
_fixture.CreateBucket(bucketName: bucketName, location: _fixture.KmsKeyLocation);
42+
var bucket = bucketSetEncConfigSample.SetBucketEncryptionEnforcementConfig(
43+
bucketName: bucketName,
44+
kmsKeyName: keyName,
45+
enforceCmek: enforceCmek,
46+
enforceGmek: enforceGmek,
47+
restrictCsek: restrictCsek);
48+
49+
string expectedCmek = enforceGmek ? "FullyRestricted" : "NotRestricted";
50+
string expectedGmek = enforceCmek ? "FullyRestricted" : "NotRestricted";
51+
string expectedCsek = (enforceCmek || enforceGmek || restrictCsek) ? "FullyRestricted" : "NotRestricted";
52+
53+
Assert.Multiple(() =>
54+
{
55+
Assert.Equal(expectedCmek, bucket.Encryption.CustomerManagedEncryptionEnforcementConfig?.RestrictionMode);
56+
Assert.Equal(expectedCsek, bucket.Encryption.CustomerSuppliedEncryptionEnforcementConfig?.RestrictionMode);
57+
Assert.Equal(expectedGmek, bucket.Encryption.GoogleManagedEncryptionEnforcementConfig?.RestrictionMode);
58+
59+
if (enforceCmek) Assert.Equal(keyName, bucket.Encryption.DefaultKmsKeyName);
60+
});
61+
}
62+
}

‎storage/api/Storage.Samples/BucketGetEncryptionEnforcementConfig.cs‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
// Copyright 2026 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
// [START storage_get_encryption_enforcement_config]
16+
17+
using Google.Apis.Storage.v1.Data;
18+
using Google.Cloud.Storage.V1;
19+
using System;
20+
21+
public class BucketGetEncryptionEnforcementConfigSample
22+
{
23+
/// <summary>
24+
/// Get the encryption enforcement configuration for the bucket.
25+
/// </summary>
26+
/// <param name="bucketName">The name of the bucket.</param>
27+
public Bucket.EncryptionData BucketGetEncryptionEnforcementConfig(string bucketName = "your-unique-bucket-name")
28+
{
29+
var storage = StorageClient.Create();
30+
var bucket = storage.GetBucket(bucketName);
31+
Console.WriteLine($"Encryption Enforcement Configuration for bucket {bucketName} is as follows:");
32+
33+
if (bucket.Encryption == null)
34+
{
35+
Console.WriteLine("No Encryption Configuration is found (Default GMEK is active)");
36+
return bucket.Encryption;
37+
}
38+
39+
var gmConfig = bucket.Encryption.GoogleManagedEncryptionEnforcementConfig;
40+
if (gmConfig != null)
41+
{
42+
Console.WriteLine($"Google Managed (GMEK) Enforcement Restriction Mode: {gmConfig.RestrictionMode}");
43+
Console.WriteLine($"Google Managed (GMEK) Enforcement Effective Time: {gmConfig.EffectiveTimeRaw}");
44+
}
45+
var cmConfig = bucket.Encryption.CustomerManagedEncryptionEnforcementConfig;
46+
if (cmConfig != null)
47+
{
48+
Console.WriteLine($"Customer Managed (CMEK) Enforcement Restriction Mode: {cmConfig.RestrictionMode}");
49+
Console.WriteLine($"Customer Managed (CMEK) Enforcement Effective Time: {cmConfig.EffectiveTimeRaw}");
50+
}
51+
var csConfig = bucket.Encryption.CustomerSuppliedEncryptionEnforcementConfig;
52+
if (csConfig != null)
53+
{
54+
Console.WriteLine($"Customer Supplied (CSEK) Enforcement Restriction Mode: {csConfig.RestrictionMode}");
55+
Console.WriteLine($"Customer Supplied (CSEK) Enforcement Effective Time: {csConfig.EffectiveTimeRaw}");
56+
}
57+
return bucket.Encryption;
58+
}
59+
}
60+
// [END storage_get_encryption_enforcement_config]

‎storage/api/Storage.Samples/BucketRemoveAllEncryptionEnforcementConfig.cs‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Copyright 2026 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
// [START storage_remove_all_encryption_enforcement_config]
16+
17+
using Google.Apis.Storage.v1.Data;
18+
using Google.Cloud.Storage.V1;
19+
using System;
20+
21+
public class BucketRemoveAllEncryptionEnforcementConfigSample
22+
{
23+
/// <summary>
24+
/// Remove all encryption enforcement configurations from the bucket.
25+
/// </summary>
26+
/// <param name="bucketName">The name of the bucket.</param>
27+
public Bucket BucketRemoveAllEncryptionEnforcementConfig(string bucketName = "your-unique-bucket-name")
28+
{
29+
var storage = StorageClient.Create();
30+
var bucket = storage.GetBucket(bucketName);
31+
32+
if (bucket.Encryption is null
33+
|| (bucket.Encryption.CustomerManagedEncryptionEnforcementConfig is null
34+
&& bucket.Encryption.CustomerSuppliedEncryptionEnforcementConfig is null
35+
&& bucket.Encryption.GoogleManagedEncryptionEnforcementConfig is null))
36+
{
37+
Console.WriteLine($"No Encryption Enforcement Configuration found for bucket {bucketName}");
38+
return bucket;
39+
}
40+
41+
bucket.Encryption = new Bucket.EncryptionData
42+
{
43+
DefaultKmsKeyName = bucket.Encryption.DefaultKmsKeyName
44+
};
45+
46+
bucket = storage.UpdateBucket(bucket);
47+
Console.WriteLine($"The Encryption Enforcement Configuration has been removed from the bucket {bucketName}");
48+
return bucket;
49+
}
50+
}
51+
// [END storage_remove_all_encryption_enforcement_config]

‎storage/api/Storage.Samples/BucketSetEncryptionEnforcementConfig.cs‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
// Copyright 2026 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
// [START storage_set_encryption_enforcement_config]
16+
17+
using Google.Apis.Storage.v1.Data;
18+
using Google.Cloud.Storage.V1;
19+
using System;
20+
21+
public class BucketSetEncryptionEnforcementConfigSample
22+
{
23+
/// <summary>
24+
/// Set the encryption enforcement configuration for a bucket.
25+
/// </summary>
26+
/// <param name="bucketName">The name of the bucket.</param>
27+
/// <param name="kmsKeyName">
28+
/// The full resource name of the Cloud KMS key (CMEK).
29+
/// Required if <paramref name="enforceCmek"/> is true.
30+
/// </param>
31+
/// <param name="enforceCmek">If true, enforces Customer-Managed Encryption Key.</param>
32+
/// <param name="enforceGmek">If true, enforces Google-Managed Encryption Key.</param>
33+
/// <param name="restrictCsek">If true, restricts Customer-Supplied Encryption Key.</param>
34+
public Bucket SetBucketEncryptionEnforcementConfig(
35+
string bucketName = "your-unique-bucket-name",
36+
string kmsKeyName = null,
37+
bool enforceCmek = false,
38+
bool enforceGmek = false,
39+
bool restrictCsek = false)
40+
{
41+
var storage = StorageClient.Create();
42+
var bucket = storage.GetBucket(bucketName);
43+
44+
if (bucket.Encryption == null)
45+
{
46+
bucket.Encryption = new Bucket.EncryptionData();
47+
}
48+
49+
if (!string.IsNullOrEmpty(kmsKeyName))
50+
{
51+
bucket.Encryption.DefaultKmsKeyName = kmsKeyName;
52+
Console.WriteLine($"Default Key Set: {kmsKeyName}");
53+
}
54+
else
55+
{
56+
bucket.Encryption.DefaultKmsKeyName = null;
57+
Console.WriteLine("Default Key Set: None");
58+
}
59+
60+
string cmek = "NotRestricted", csek = "NotRestricted", gmek = "NotRestricted";
61+
string message = null;
62+
63+
if (enforceCmek)
64+
{
65+
csek = gmek = "FullyRestricted";
66+
message = "CMEK-only enforcement policy";
67+
}
68+
else if (enforceGmek)
69+
{
70+
cmek = csek = "FullyRestricted";
71+
message = "GMEK-only enforcement policy";
72+
}
73+
else if (restrictCsek)
74+
{
75+
csek = "FullyRestricted";
76+
message = "policy to restrict CSEK";
77+
}
78+
79+
bucket.Encryption.CustomerManagedEncryptionEnforcementConfig = new Bucket.EncryptionData.CustomerManagedEncryptionEnforcementConfigData { RestrictionMode = cmek };
80+
bucket.Encryption.CustomerSuppliedEncryptionEnforcementConfig = new Bucket.EncryptionData.CustomerSuppliedEncryptionEnforcementConfigData { RestrictionMode = csek };
81+
bucket.Encryption.GoogleManagedEncryptionEnforcementConfig = new Bucket.EncryptionData.GoogleManagedEncryptionEnforcementConfigData { RestrictionMode = gmek };
82+
83+
if (message != null)
84+
{
85+
Console.WriteLine($"Bucket {bucketName} updated with {message}");
86+
}
87+
88+
var updatedBucket = storage.UpdateBucket(bucket);
89+
return updatedBucket;
90+
}
91+
}
92+
// [END storage_set_encryption_enforcement_config]

0 commit comments

Comments
 (0)