This page describes how to disable the soft delete feature on new and existing buckets across your organization.
Soft delete is enabled on new buckets by default to prevent data loss. If needed, you can disable soft delete for existing buckets by modifying the soft delete policy, and you can disable soft delete by default for new buckets by setting an organization-wide default tag. Note that once you disable soft delete, your deleted data cannot be recovered, including accidental or malicious deletions.
Required roles
To get the permissions that you need to disable soft delete, ask your administrator to grant you the following IAM roles on the organization level:
-
Storage Admin (
roles/storage.admin
) -
Tag Administrator (
roles/resourcemanager.tagAdmin
) -
Organization Viewer (
roles/resourcemanager.organizationViewer
)
These predefined roles contain the permissions required to disable soft delete. To see the exact permissions that are required, expand the Required permissions section:
Required permissions
The following permissions are required to disable soft delete:
-
storage.buckets.get
-
storage.buckets.update
-
storage.buckets.list
(this permission is only required if you plan to use the Google Cloud console to perform the instructions on this page)For required permissions that are included as part of the Tag Admin(
roles/resourcemanager.tagAdmin
) role, seeRequired permissions for administering tags.
For information about granting roles, see Use IAM with buckets or Manage access to projects.
Disable soft delete for a specific bucket
Before you begin, consider the following:
If you disable a soft delete policy from your bucket that has soft-deleted objects in it during the time of disablement, the existing soft-deleted objects are retained until the previously applied retention duration expires.
After disabling a soft delete policy on your bucket, Cloud Storage doesn't retain newly deleted objects.
Use the following instructions to disable soft delete for a specific bucket:
Console
- In the Google Cloud console, go to the Cloud Storage Buckets page.
In the list of buckets, click the name of the bucket whose soft delete policy you want to disable.
Click the Protection tab.
In the Soft delete policy section, click Disable to disable the soft delete policy.
Click Confirm.
To learn how to get detailed error information about failed Cloud Storage operations in the Google Cloud console, see Troubleshooting.
Command line
Run the gcloud storage buckets update
command with the
--clear-soft-delete
flag:
gcloud storage buckets update --clear-soft-delete gs://BUCKET_NAME
Where:
BUCKET_NAME
is the name of the bucket. For example,my-bucket
.
REST APIs
JSON API
Have gcloud CLI installed and initialized, which lets you generate an access token for the
Authorization
header.Create a JSON file that contains the following information:
{ "softDeletePolicy": { "retentionDurationSeconds": "0" } }
Use
cURL
to call the JSON API with aPATCH
Bucket request:curl -X PATCH --data-binary @JSON_FILE_NAME \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json" \ "https://storage.googleapis.com/storage/v1/b/BUCKET_NAME"
Where:
JSON_FILE_NAME
is the path for the JSON file that you created in Step 2.BUCKET_NAME
is the name of the relevant bucket. For example,my-bucket
.
Disable soft delete for the 100 largest buckets in a project
Using the Google Cloud console you can disable soft delete for up to 100 buckets at once, with buckets sorted by the most soft-deleted bytes or the highest ratio of soft-deleted bytes to live bytes, allowing you to manage buckets with the greatest impact to your soft delete costs.
- In the Google Cloud console, go to the Cloud Storage Buckets page.
In the Cloud Storage page, click Settings.
Click the Soft delete tab.
From the Top buckets by deleted bytes list, select the buckets you want to disable soft delete for.
Click Turn off soft delete.
Soft delete is disabled on the buckets you selected.
Disable soft delete for multiple or all buckets within a project
Using the Google Cloud CLI, run the gcloud storage buckets update
command with the --project
flag and the *
wildcard to bulk
disable soft delete for multiple or all buckets within a project:
gcloud storage buckets update --project=PROJECT_ID --clear-soft-delete gs://*
Where:
PROJECT_ID
is the ID of the project. For example,my-project
.
Disable soft delete across all buckets within a folder
Using the Google Cloud CLI, run the gcloud projects list
and
gcloud storage buckets update
commands to disable soft delete on buckets
across all the projects in a specified folder.
Run the
gcloud projects list
andgcloud storage buckets update
commands to list all the buckets under a specified folder and then disable soft delete for all buckets within the folder:gcloud projects list --filter="parent.id: FOLDER_ID" --format="value(projectId)" | while read project do gcloud storage buckets update --project=$project --clear-soft-delete gs://* done
Where:
FOLDER_ID
is the name of the folder. For example,123456
.
Disable soft delete at the organization level
Using the Google Cloud CLI, run the gcloud storage buckets update
command with the --clear-soft-delete
flag and the *
wildcard to
disable soft delete at the organization level:
Run the
gcloud storage buckets update
command with the--clear-soft-delete
flag and the*
wildcard to disable soft delete for all buckets within your organization:gcloud projects list --format="value(projectId)" | while read project do gcloud storage buckets update --project=$project --clear-soft-delete gs://* done
Cloud Storage disables soft delete on existing buckets. Objects that have already been soft deleted will remain in the buckets until their soft delete retention duration completes, after which, they are permanently deleted.
Disable soft delete for new buckets
While soft delete is enabled by default on new buckets,
you can prevent soft delete from default enablement using tags.
Tags use the storage.defaultSoftDeletePolicy
key to apply a 0d
(zero days)
soft delete policy at the organization level, which disables the
feature and prevents future retention of deleted data.
Use the following instructions to disable soft delete by default when you create new buckets. Note that the following instructions aren't equivalent to setting an organization policy that mandates a particular soft delete policy, meaning you can still enable soft delete on specific buckets by specifying a policy if needed.
Using the Google Cloud CLI, create the
storage.defaultSoftDeletePolicy
tag which is used to change the default soft delete retention duration on new buckets. Note that only thestorage.defaultSoftDeletePolicy
tag name updates the default soft delete retention duration.Create a tag key using the
gcloud resource-manager tags keys create
command:gcloud resource-manager tags keys create storage.defaultSoftDeletePolicy \ --parent=organizations/ORGANIZATION_ID \ --description="Configures the default softDeletePolicy for new Storage buckets."
Where:
ORGANIZATION_ID
is the numeric ID of the organization you want to set a default soft delete retention duration for. For example,12345678901
. To learn how to find the organization ID, see Getting your organization resource ID.
Create a tag value for
0d
(zero days) to disable the soft delete retention period by default on new buckets using thegcloud resource-manager tags values create
command:gcloud resource-manager tags values create 0d \ --parent=ORGANIZATION_ID/storage.defaultSoftDeletePolicy \ --description="Disables soft delete for new Storage buckets." done
Where:
ORGANIZATION_ID
is the numeric ID of the organization you want to set the default soft delete retention duration for. For example,12345678901
.
Attach the tag to your resource using the
gcloud resource-manager tags bindings create
command:gcloud resource-manager tags bindings create \ --tag-value=ORGANIZATION_ID/storage.defaultSoftDeletePolicy/0d \ --parent=RESOURCE_ID
Where:
ORGANIZATION_ID
is the numeric ID of the organization under which the tag was created. For example,12345678901
.RESOURCE_ID
is the full name of the organization you want to create the tag binding for. For example, to attach a tag toorganizations/7890123456
, enter//cloudresourcemanager.googleapis.com/organizations/7890123456
.
Disable soft delete for buckets that exceed a specified cost threshold
Using the Cloud Client Libraries for Python, you can disable soft delete for buckets that exceed a specified relative cost threshold with a Python client library sample. The sample does the following:
Calculates the relative cost of storage for each storage class.
Assesses the soft delete cost accumulated by your buckets.
Sets a cost threshold for soft delete usage and lists the buckets that exceed the threshold you set and lets you disable soft delete for the buckets that exceed the threshold.
To learn more about setting up the Python client library and using the sample,
see the
Cloud Storage soft delete cost analyzer README.md
page.
The following sample disables soft delete for buckets that exceed a specified cost threshold:
What's next
Review considerations before re-enabling soft delete.
Learn about how soft delete interacts with other Cloud Storage features.