Cloud Storage release notes

Bucket IP filtering for Cloud Storage is now available in Preview. With bucket IP filtering, you can restrict access to a bucket based on the source IP address of the request and secure your data from unauthorized access.

You can now restore soft-deleted buckets. If you delete a bucket with an active soft delete policy, Cloud Storage retains the bucket for the specified soft delete retention duration, during which the bucket can be restored to a live state. To learn more about the bucket restore feature, see Use soft-deleted buckets.

You can now use the Google Cloud console to get soft delete recommendations for buckets. Soft delete recommendations help you determine when it's best to enable or disable the soft delete feature on a bucket based on impact to cost and security.

Connecting to Cloud Storage using gRPC is generally available (GA). You can use gRPC to interact with Cloud Storage.

You can now emit client-side metrics for gRPC. To learn which metrics are supported and how to emit them, see Use gRPC client-side metrics.

Hierarchical namespace for Cloud Storage buckets is generally available (GA). With hierarchical namespace, you can store your data in a logical file system structure.

Cross-bucket replication is now available in Cloud Storage. You can use cross-bucket replication to copy new and updated objects asynchronously from a source bucket to a destination bucket. For more information on how to use cross-bucket replication, see Using cross-bucket replication.

Cloud Storage is now enabled for use with Cloud KMS Autokey.

Using keys generated by Autokey can help you consistently align with industry standards and recommended practices for data security, including the HSM protection level, separation of duties, key rotation, location, and key specificity. Keys requested using Autokey function identically to other Cloud HSM keys with the same settings.

For more information, see Customer-managed encryption keys. To learn more about Cloud KMS Autokey, see Autokey overview.

You can now use hierarchical namespace with Cloud Storage FUSE. To learn more about how mounting buckets with hierarchical namespace enabled can help improve performance, see Mount buckets with hierarchical namespace enabled.

You can now specify United States regions when using regional endpoints.

You can now use the Google Cloud console to do the following:

• Create buckets with hierarchical namespace enabled. To learn more, see Create a bucket.

• Create and manage folders in buckets with hierarchical namespace enabled. To learn more, see Create and manage folders.

• Rename and move folders. To learn more, see Rename and move folders.

You can now use parallel downloads with Cloud Storage FUSE to accelerate read performance of large files over 1 GB in size. When enabled, parallel downloads use multiple workers to download a file in parallel, accelerating file reads. For more information, see Improve read performance using parallel downloads.

You can now use list caching with Cloud Storage FUSE, which is a cache for directory and file list, or ls, responses that improves list operation speeds. To learn more about list caching and how to enable it, see the Cloud Storage FUSE caching overview page.

You can now use the Google Cloud console to set a default soft delete retention duration. For more information, see Use tags to set a default soft delete retention duration for new buckets.

You can now use tags to set a default soft delete retention duration on newly created buckets in your organization. To learn how to customize a default soft delete retention duration, see Set a default soft delete retention duration.

You can now specify Frankfurt (europe-west3) and Zürich (europe-west6) as a predefined dual-region pairing. For more information, see Predefined dual-regions.

You can now specify London (europe-west2) and Frankfurt (europe-west3) as a predefined dual-region pairing. For more information, see Predefined dual-regions.

You can now disable soft delete for multiple buckets at a time or for all buckets in a project. To learn more, see Bulk disable soft delete.

You can now specify the Frankfurt, Germany (europe-west3) and Paris, France (europe-west9) regions when using regional endpoints.

Hierarchical namespace for Cloud Storage buckets is now available in Preview. With hierarchical namespace, you can store your data in a logical file system structure.

Cloud Storage now offers a new pre-defined dual region, EUROPE-WEST2 (London) and EUROPE-WEST1 (Belgium). To learn more about Cloud Storage pre-defined dual regions, see the Bucket locations page.

Cloud Storage FUSE now offers the following features:

• You now have the option to disable authentication on custom endpoints using the --anonymous-access flag. For more information about the new global option, see the Cloud Storage FUSE CLI options page.
• Cloud Storage FUSE now supports Rocky Linux versions 8.9 or later. For more information, see Cloud Storage FUSE instructions on how to configure the package manager.
• The Cloud Storage FUSE max-conns-per-host flag has been updated to offer a default value which specifies no limit on TCP connections except for limitations set by your machine's specifications. For more information, see the Cloud Storage FUSE CLI page.

Custom constraints for Cloud Storage are now available. You can use custom constraints to enforce policies on Cloud Storage resources, such as a policy that enforces all buckets to have Object Versioning enabled.

Managed folders are now available in the Google Cloud Console.

You can now use managed folders in your Cloud Storage buckets using the Cloud Console. You can create, list, move, and delete your managed folders in the Console, as well as set IAM policies. To learn more, see Create and manage managed folders.

Google Cloud Storage now offers Dual-region Google Egress Bandwidth quotas per dual-region location. See Bandwidth usage in Cloud Storage.

The Storage Control API is now available for use. The Storage Control API lets you perform metadata-specific, control plane, and long-running operations. To learn more about the Storage Control API and operations you can perform, see Storage Control API overview.

You can now use the GCS FUSE file cache feature, a client-based read cache that lets repeat file reads to be served from a faster cache storage of your choice. To learn more about caching, see GCS FUSE caching documentation.

You can now view granular bucket-level cost data in the Cloud Billing Detailed data export.

Cloud Storage is now available in Johannesburg, South Africa (africa-south1 region).

Cloud Storage FUSE now provides the ability to configure log rotation.

The restrict unencrypted HTTP requests organization policy constraint is now generally available (GA). This constraint blocks all unencrypted HTTP access to Cloud Storage resources.

The Object Retention Lock feature is now available.

• Using this feature, you can place a retention configuration on individual objects.

• A retention configuration defines a date prior to which the object cannot be deleted or overwritten.

• A retention configuration can optionally be locked to prevent the retention date from being shortened or removed.

Regional endpoints are now available in Preview. Regional endpoints let you run your workloads in a manner that complies with data residency and data sovereignty requirements, where your request traffic is routed directly to the region specified in the endpoint.

Managed folders are now available in Preview. When using managed folders, you can organize your objects by group and set IAM policies that offer more granular access control over data segments within a bucket.

The Node.js and Python client libraries now have parallelized upload and download options, improving their performance.

• Both client libraries have improved bulk uploads, bulk downloads, large object uploads, and large object downloads.

You can now control the mounting behavior of Cloud Storage FUSE by using a configuration file instead of global options.

Cloud Storage is now available in Dammam, Saudi Arabia (me-central2 region).

Manifest files are now available in Storage Insights. A manifest file is generated when an inventory report is split into shards. You can use the manifest file to easily locate the shards you want to download.

The Storage Object User role (roles/storage.objectUser) is now available. This role allows you to create, view, list, update, and delete objects and their metadata, without granting access to the object's ACLs.

Cloud Storage is now available in Berlin, Germany (europe-west10 region).

You can now use locational endpoints to perform operations in a manner that's compliant with International Traffic in Arms Regulations (ITAR).

Custom audit logging for Cloud Storage is now generally available (GA). In addition to using the Cloud Storage JSON API, you can now attach custom information to audit logs for requests by using the following tools:

• The gcloud or gsutil command-line tools
• The Cloud Storage client libraries
• The Cloud Storage XML API
• Signed URLs

Cloud Storage FUSE is now generally available.

Custom audit logging for Cloud Storage is now available in Preview.

• JSON API requests now support user-defined headers that are prefixed with x-goog-custom-audit-.
• Cloud Audit Logs can subsequently include these headers as part of your request's audit log entry.

The Storage Insights inventory reports feature is now generally available. Inventory reports provide an overview of metadata for all objects in a bucket.

Cloud Storage FUSE is now available in Preview. You can use Cloud Storage FUSE to mount and access storage buckets as local file systems.

• Get started with mounting buckets using Cloud Storage FUSE.
• Learn about integrations between Cloud Storage FUSE and other Google Cloud products.

Cloud Storage is now available in Doha, Qatar (me-central1 region).

Cloud Storage is now available in Turin, Italy (europe-west12 region).

The following US regions are now available for dual-region storage:

• Los Angeles (us-west2)
• Salt Lake City (us-west3)

The following EU regions are now available for dual-region storage:

• Warsaw (europe-central2)
• Madrid (europe-southwest1)
• Frankfurt (europe-west3)
• Milan (europe-west8)
• Paris (europe-west9)

Expanded Cloud Storage monitoring dashboards are now generally available (GA).

• Available metrics include server and client error rates, write request counts, network ingress rates, and network egress rates.
• Dashboards can be filtered by bucket location.
• Dashboards are customizable, including the ability to set up alerts.

You can now use the Google Cloud console to get role recommendations and policy insights for buckets. Role recommendations and policy insights help you understand and manage permission usage for your buckets.

Expanded Cloud Storage monitoring dashboards are now available in Preview.

• Available metrics include server and client error rates, write request counts, network ingress rates, and network egress rates.
• Dashboards can be filtered by bucket location.
• Dashboards are customizable, including the ability to set up alerts.

In addition to the project-wide dashboard, per-bucket dashboards are available in a new Observability tab in the Bucket Details for each bucket.

The Autoclass feature is now available.

• When enabled, Autoclass transitions the storage classes of your objects automatically based on their access patterns.
• Currently, Autoclass can only be enabled at the time of bucket creation.

Bucket tags are now generally available (GA).

New public dataset stored in Cloud Storage.

• Data for ERA5 are now hosted publicly in Cloud Storage.

Cloud Storage is now available in Tel Aviv, Israel (me-west1 region).

The restrict authentication types organization policy constraint is now generally available (GA). This constraint allows you to restrict the authentication types that can be used in requests for Cloud Storage resources.

Customer-managed encryption key (CMEK) organization policy constraints are now generally available (GA).

• constraints/gcp.restrictNonCmekServices allows you to control which resources require the use of CMEK.
• constraints/gcp.restrictCmekCryptoKeyProjects allows you to control the projects from which a Cloud KMS key can be used to validate requests.
• You can use both constraints together to enforce the use of CMEK from allowed projects.

New commands are now available gcloud alpha storage.

• Commands include the ability to create buckets, view metadata for buckets and objects, and edit metadata for buckets and objects.
• Note that all Cloud Storage gcloud commands continue to be in Preview.

Bucket tags are now available in Preview. You can apply tags to buckets for fine-grained access control.

Configurable dual-region storage is generally available (GA).

Object Lifecycle Management now supports new conditions and a new action.

• The MatchesPrefix and MatchesSuffix conditions allow you to restrict lifecycle actions to objects with specific prefixes and suffixes.

• The AbortIncompleteMultipartUpload action allows you to remove abandoned XML API multipart uploads.

Cloud Storage is now available in Dallas, Texas (us-south1 region).

Cloud Storage is now available in Columbus, Ohio (us-east5 region).

Cloud Storage is now available in Madrid, Spain (europe-southwest1 region).

Cloud Storage is now available in Paris, France (europe-west9 region).

Cloud Storage is now available in Milan, Italy (europe-west8 region).

With dual-region storage, users can now specify two regions within the same continent to create a dual-region of their choosing. This feature is now in Preview.

Customer-managed encryption key (CMEK) organization policy constraints are now available in Preview.

• constraints/gcp.restrictNonCmekServices allows you to control which resources require the use of CMEK.
• constraints/gcp.restrictCmekCryptoKeyProjects allows you to control the projects from which a Cloud KMS key can be used to validate requests.
• You can use both constraints together to enforce the use of CMEK from allowed projects.

The restrict authentication types organizational constraint is now in Preview.

• The constraint allows you to restrict the authentication types that can be used in requests for Cloud Storage resources.

Santiago region (southamerica-west1) launched.

New location for storing your data.

List Object V2 is generally available (GA).

Cloud EKM keys can now be used to encrypt Cloud Storage data.

• Cloud EKM keys encrypt your Cloud Storage data in the same way as other customer-managed encryption keys.

Turbo replication is a premium feature designed to provide inter-region replication for newly written objects within 15 minutes.

This feature is now available in Preview.

Object Versioning can now be managed in the Cloud Console.

• You can enable and disable Object Versioning using the Cloud Console.

• You can list, restore, copy, move, and delete versioned objects from within the Cloud Console.

Toronto region (northamerica-northeast2) launched.

• New location for storing your data.

gcloud alpha storage commands are now available.

• These commands provide faster uploading and downloading performance over the gsutil command line tool.

List object V2 for the XML API^Preview launched.

• List object V2 provides improved interoperability with Amazon S3 tools and libraries.

Public access prevention^Preview launched.

• Enforcing public access prevention prevents data in your organization or project from being accidentally exposed to the public.

Delhi region (asia-south2) launched.

• New location for storing your data.

Melbourne region (australia-southeast2) launched.

• New location for storing your data.

XML API multipart uploads^Preview launched.

Warsaw region (europe-central2) launched.

• New location for storing your data.

Tokyo+Osaka dual-region (asia1) launched.

• New location for storing your data.

New conditions available for Object Lifecycle Management:

• Noncurrent time conditions allow you to define lifecycle actions based on when an object became noncurrent.
• Custom time conditions allow you to define lifecycle actions based on a custom time that you define for objects.

Custom time metadata is now available for objects.

• Custom time metadata allows you to associate an arbitrary date and time with objects.

Detailed audit logging mode launched.

Jakarta region (asia-southeast2) launched.

• New location for storing your data.

Las Vegas region (us-west4) launched.

• New location for storing your data.

Salt Lake City region (us-west3) launched.

• New location for storing your data.

Seoul region (asia-northeast3) launched.

• New location for storing your data.

Archive Storage now available.

• New storage class for storing your long-term, rarely accessed data.

IAM Conditions^BETA for Cloud Storage is now available.

• IAM Conditions allows you to grant permissions for a specified period of time, or to a subset of objects in your buckets.
• See Using IAM Conditions on buckets for step-by-step instructions.

HMAC keys for service accounts^BETA are now available.

• Use HMAC keys to create signed requests for the XML API.
• Creating HMAC keys for service accounts replaces the need to have HMAC keys for user accounts.

Dual-regions are now in GA.

You can now inspect buckets for sensitive information using Cloud Data Loss Prevention in the Google Cloud Console.

• See Inspect a Cloud Storage location for step-by-step instructions.

Osaka region (asia-northeast2) launched.

• New location for storing your data.

V4 signing process^BETA launched.

• The V4 signing process is an improved method for creating signed requests using RSA or HMAC signatures.
• Use the process to create signed URLs.

Zürich region (europe-west6) launched.

• New location for storing your data.

Bucket Policy Only^BETA launched.

• Bucket Policy Only unifies your access controls by disabling object-level ACLs.
• You can set an organizational policy that helps to enforce the use of Bucket Policy Only in your buckets.

Hong Kong region (asia-east2) launched.

• New location for storing your data.

Retention policies and object holds are now available.

• Retention policies allow you to set a minimum age that objects must reach before they can be deleted or overwritten.
• You can lock your policy so that it can not be removed or reduced.
• You can place holds on your objects as another way to prevent unintended deletion or overwrite.

Dual-regions^BETA launched.

• Data stored in a dual-regional location have copies stored in two specific locations.

C++ Cloud Storage Client Library^ALPHA

• See the list of Cloud Storage guides for code samples that use the client library.

Los Angeles region (us-west2) launched.

• New location for storing your data.

Finland region (europe-north1) launched.

• New location for storing your data.

Customer-Managed Encryption Keys^BETA.

• Cloud Key Management Service keys with Cloud Storage allow you to manage the encryption keys used on your Cloud Storage objects.
• Google Cloud Platform Console functionality for the feature is fully available starting April 20.

Montréal region (northamerica-northeast1) launched.

• New location for storing your data.

Netherlands region (europe-west4) launched.

• New location for storing your data.

Requester Pays feature is now available.

• When enabled on a bucket, users accessing the bucket or its contents must specify a project to bill for charges that arise from their request.
• Callers can specify a billing project on requests to buckets both with and without Requester Pays enabled.

Mumbai region (asia-south1) launched.

• New location for storing your data.

São Paulo region (southamerica-east1) launched.

• New location for storing your data.

Frankfurt region (europe-west3) launched.

• New location for storing your data.

Sydney region (australia-southeast1) launched.

• New location for storing your data.

New public dataset stored in Cloud Storage.

• Data for NEXRAD are now hosted publicly in Cloud Storage.

London region (europe-west2) launched.

• New location for storing your data.

Northern Virginia region (us-east4) launched.

• New location for storing your data.

Singapore region (asia-southeast1) launched.

• New location for storing your data.

Labels can now be used with your buckets in order to better organize all of your Google Cloud Platform resources.

Cloud Pub/Sub Notifications for Cloud Storage^BETA

• Track changes to objects in your buckets through notifications sent to Cloud Pub/Sub.
• You can set the event types that generate notifications as well as the information contained within notifications.

asia-northeast1 region launched.

• New location for storing your data.

Coldline, a new archival storage class, is now available.

• The Coldline Storage class provides low price, immediately accessible data storage for your backup, archival and disaster recovery needs.
• Ideal for data that intends to be accessed less than once a year.

Per-object storage classes^BETA

• Users can set the storage class at the object level.
• Users can configure lifecycle management to automatically change the storage class of an object when designated criteria are met.

Public datasets stored in Cloud Storage

• Datasets for the Landsat and Sentinel-2 missions are now hosted publicly in Cloud Storage.
• Read about the Landsat dataset
• Read about the Sentinel-2 dataset

Alpha release for bucket-level IAM.

• Access to this feature is currently by request/invite only. Apply IAM permissions to individual buckets in your projects.

us-west1 region launched.

• New location for storing your data.

X-Goog-Content-Length-Range custom header available.

• New header for XML and JSON.
• Allows for checking the size of content sent to Cloud Storage.