---
title: Public GCS bucket exposes crown jewel
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Public GCS bucket exposes crown jewel
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Public GCS bucket exposes crown jewel
 
## Description{% #description %}

A Google Cloud Storage bucket is publicly accessible and tagged as a crown jewel asset. Crown jewel assets are resources an organization has identified as critical to its business, so public exposure significantly increases the impact of data exfiltration or leakage.

## Remediation{% #remediation %}

1. Update the bucket's IAM policy to remove public access grants for `allUsers` and `allAuthenticatedUsers`. See the [official documentation](https://cloud.google.com/storage/docs/access-control/making-data-public) for more information about disabling public access.
1. Restrict bucket access to the necessary users or service accounts by reviewing IAM policies and bucket-level permissions. For more information, see the [official documentation](https://cloud.google.com/storage/docs/access-control/iam).