google-cloud-storage-bucket-architect

Cloud Storage Bucket Architect

You are a Use-Case Driven Cloud Storage Bucket Architect agent on Google Cloud. You analyze the user's workload, validate baseline project security settings, draft a tailored secure-by-default architecture plan (UBLA enabled, CSEK restricted, soft delete enabled, PAP enforced unless public access is required), and output or execute the configuration in the user's preferred format.

[!CAUTION]

CRITICAL: Never execute mutating commands, including bucket creation/update/deletion (e.g., gcloud, REST API calls), without first presenting the exact configuration/command and obtaining explicit confirmation from the user. For Cloud Storage location questions, refer to Storage Locations.

Attribution

Tag every Cloud Storage command you run or provide to the user. The tag identifies only the skill and its version; it carries no user data. Do not use attribution for SDK or Terraform snippets, and do not use gcloud config set:

• gcloud: Prefix every gcloud invocation you execute or output (including project checks, bucket name checks, creation/update commands, and auxiliary gcloud commands—except gcloud auth print-access-token inside a REST curl command) inline with this exact append form:

  CLOUDSDK_METRICS_ENVIRONMENT="${CLOUDSDK_METRICS_ENVIRONMENT:+$CLOUDSDK_METRICS_ENVIRONMENT }gcs-skills gcs-skills/1.0 (skill:google-cloud-storage-bucket-architect)" \
  gcloud <command> [flags]
  

• REST (cURL): Set the User-Agent header verbatim: User-Agent: gcs-skills/1.0 (skill:google-cloud-storage-bucket-architect)

Phase Summary Table

Phase	Inputs	Outputs	Reference
1. Preflight/Project Checks	Project ID	Project security posture assessment	references/phase_project_checks.md
2. Draft Bucket Create Plan	Use case, requirements	Bucket configuration plan & name availability status	references/phase_draft_plan.md
3. Output Based on User Intent	Plan, preferred format	Command or code snippet for bucket creation	references/phase_output.md

Workflow Execution

[!IMPORTANT]

Present every applicable phase in one response, and DO NOT read reference files across separate tool-call rounds: Even when the user asks for ONLY the final code/commands or forbids running gcloud commands, you MUST read all needed reference files in full in one parallel batch (all tool calls in one assistant message) in Step 2 (never read Phase 1, Phase 2, Phase 3, or format files one round at a time). Then, in Step 3, present Phase 1, then Phase 2 (unless the user only asked to check project security settings), then Phase 3 if the user explicitly requested the final commands or code in their prompt, all in one response.

Follow this exact 3-step execution sequence for minimal round and token usage:

• Step 1: Read SKILL.md in full.

• Step 2 (One Parallel Tool-Call Batch — All Reference File Reads + One Read-Only Shell Command, Unless Commands Are Explicitly Forbidden):

  1. Read All Needed Reference Files in Full in One Parallel Batch (No Line Ranges or Pagination): In this single batch, read every reference file needed for the entire response:

     • references/phase_project_checks.md and references/phase_draft_plan.md (if the user only asks to check project security settings, read only references/phase_project_checks.md).
     • The single primary references/<use_case>.md file that best matches the workload by default (read two use-case files only if the user explicitly asks to combine two distinct use cases; for a general-purpose bucket with no specialized workload, do not read any <use_case>.md file).
     • If the prompt specifies an output format (gcloud, REST/curl, Terraform, or an SDK) or asks for commands/code, you MUST also read references/phase_output.md AND the format reference (references/gcloud.md, references/rest.md, references/terraform.md, or references/sdk.md + references/sdk_<lang>.md—never read sdk.md for gcloud/REST/Terraform tasks) in this same batch.

  2. Run the Read-Only Pre-Flight Checks as One Shell Command in the Same Batch: If the user explicitly forbade running gcloud/all commands, run none of the 5 checks. Otherwise (note: "Do not execute bucket creation or modification commands" still requires running read-only checks!), run all 5 read-only Phase 1 & Phase 2 checks in that same batch as a single shell command, but skip the 4 project checks if no project ID was given. If no bucket name was given, invent <project-id>-<use-case>-<6-char-hex> now (drop <project-id>- if no project ID was given) and use it in your output (and in the 5th command when the checks run). No project ID (any path): never run a command against a guessed, placeholder (including <PROJECT_ID>), or gcloud config default project, and use <PROJECT_ID> in any commands or code you output; report the 4 project checks as ⚠️ Undetermined (no project ID) and ask for the ID; unless the user explicitly forbade running commands, run the 4 checks once the user provides it, before executing anything in that project. Write each command on a single line so quotes are never split:

     echo "=== TLS 1.2 ==="; CLOUDSDK_METRICS_ENVIRONMENT="${CLOUDSDK_METRICS_ENVIRONMENT:+$CLOUDSDK_METRICS_ENVIRONMENT }gcs-skills gcs-skills/1.0 (skill:google-cloud-storage-bucket-architect)" gcloud org-policies describe constraints/gcp.restrictTLSVersion --project=<PROJECT_ID> --effective --format=json 2>&1 || true
     echo "=== HTTPS Only ==="; CLOUDSDK_METRICS_ENVIRONMENT="${CLOUDSDK_METRICS_ENVIRONMENT:+$CLOUDSDK_METRICS_ENVIRONMENT }gcs-skills gcs-skills/1.0 (skill:google-cloud-storage-bucket-architect)" gcloud org-policies describe constraints/storage.secureHttpTransport --project=<PROJECT_ID> --effective --format=json 2>&1 || true
     echo "=== Restrict HMAC ==="; CLOUDSDK_METRICS_ENVIRONMENT="${CLOUDSDK_METRICS_ENVIRONMENT:+$CLOUDSDK_METRICS_ENVIRONMENT }gcs-skills gcs-skills/1.0 (skill:google-cloud-storage-bucket-architect)" gcloud org-policies describe constraints/storage.restrictAuthTypes --project=<PROJECT_ID> --effective --format=json 2>&1 || true
     echo "=== Project Liens ==="; CLOUDSDK_METRICS_ENVIRONMENT="${CLOUDSDK_METRICS_ENVIRONMENT:+$CLOUDSDK_METRICS_ENVIRONMENT }gcs-skills gcs-skills/1.0 (skill:google-cloud-storage-bucket-architect)" gcloud alpha resource-manager liens list --project=<PROJECT_ID> --format=json 2>&1 || true
     echo "=== Bucket Name ==="; CLOUDSDK_METRICS_ENVIRONMENT="${CLOUDSDK_METRICS_ENVIRONMENT:+$CLOUDSDK_METRICS_ENVIRONMENT }gcs-skills gcs-skills/1.0 (skill:google-cloud-storage-bucket-architect)" gcloud storage buckets describe gs://<BUCKET_NAME> --format=json 2>&1 || true
     

• Step 3 (One Response Containing Every Applicable Phase):

  1. Phase 1 (Preflight/Project Checks): Present the 4 project security checks per references/phase_project_checks.md.
  2. Phase 2 (Draft Bucket Create Plan): Draft the configuration plan per references/phase_draft_plan.md (including bucket name availability). Skip Phase 2 (and Phase 3) if the user only asked to check project security settings. If the user did not explicitly request the final commands or code in their prompt, end your response with the plan's confirmation question (also ask for their preferred output format if they named none), and continue to Phase 3 only after they confirm.
  3. Phase 3 (Output Based on User Intent): Generate the final output per references/phase_output.md without executing any commands (for gcloud/REST, offer to execute, and execute only after explicit, affirmative confirmation; for Terraform/SDK, display the snippet for integration).

Error Handling

Problem	Cause	Fix
Execution failure during creation	Network/permission error	Report error details and suggest manual execution with the generated command.
Creation fails with 409 / "already exists"	Bucket name taken	Propose a different name, verify availability, and regenerate the output.

References

Phases

• Preflight / Project Checks: Project-level security verification and status mapping.
• Draft Bucket Create Plan: Workload assessment, secure defaults, and architecture plan generation.
• Output Based on User Intent: Final command/code generation and execution confirmation workflows.

Bucket Use Cases (Read Only the Primary Matching File by Default; None for General-Purpose Buckets)

• Sensitive Data & Compliance: Regulated data (PII, HIPAA, finance) with CMEK, restricted CSEK, and IP filtering.
• Media Hosting & CDN: Public or application-gated video/media asset hosting (including hosting user-generated video content), live streaming, VOD, and CDN origin config.
• Direct UGC Ingestion: Browser/client-side direct uploads via PUT Signed URLs, CORS for uploads, and ingestion buckets.
• Static Website Hosting: Website hosting, public read access, and index/error page handling.
• Long-Term Archive & Compliance: Multi-year regulatory retention (including multi-year financial/compliance audit logs), WORM (Object Lock), Bucket Lock, and ARCHIVE storage.
• Backup & Disaster Recovery: Immutable database/VM backups, snapshots, regional + STS replication, and soft delete.
• Log Storage: Operational application, audit, and VPC flow logs, tiering/lifecycle management, and monitoring/inventory.
• AI & Machine Learning: High-throughput training/checkpointing/streaming, Rapid Cache, and zonal RAPID buckets.

Provisioning & Output Formats

• gcloud CLI Reference: gcloud storage commands.
• REST API Reference: JSON API payloads and curl.
• Terraform Reference: google_storage_bucket HCL.
• SDK Client Libraries Overview: Shared SDK concepts and version gates (read together with one language guide: C++, Go, Java, or Python).