updateBucketEncryptionEnforcementConfig.js

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

'use strict';

// sample-metadata:
//   title: Update Bucket Encryption Enforcement Config
//   description: Updates and then removes encryption enforcement configurations from a bucket.
//   usage: node updateBucketEncryptionEnforcementConfig.js <BUCKET_NAME>

function main(bucketName = 'my-bucket') {
  // [START storage_update_bucket_encryption_enforcement_config]
  /**
   * TODO(developer): Uncomment the following lines before running the sample.
   */
  // The ID of your GCS bucket
  // const bucketName = 'your-unique-bucket-name';

  // Imports the Google Cloud client library
  const {Storage} = require('@google-cloud/storage');

  // Creates a client
  const storage = new Storage();

  async function updateBucketEncryptionEnforcementConfig() {
    const bucket = storage.bucket(bucketName);

    // Update a specific encryption type's restriction mode
    // This partial update preserves other existing encryption settings.
    const updateOptions = {
      encryption: {
        googleManagedEncryptionEnforcementConfig: {
          restrictionMode: 'FullyRestricted',
        },
      },
    };

    await bucket.setMetadata(updateOptions);
    console.log(
      `Google-managed encryption enforcement set to FullyRestricted for ${bucketName}.`
    );

    // Remove all encryption enforcement configurations altogether
    // Setting these values to null removes the policies from the bucket metadata.
    const clearOptions = {
      encryption: {
        defaultKmsKeyName: null,
        googleManagedEncryptionEnforcementConfig: null,
        customerSuppliedEncryptionEnforcementConfig: null,
        customerManagedEncryptionEnforcementConfig: null,
      },
    };

    await bucket.setMetadata(clearOptions);
    console.log(
      `All encryption enforcement configurations removed from bucket ${bucketName}.`
    );
  }

  updateBucketEncryptionEnforcementConfig().catch(console.error);
  // [END storage_update_bucket_encryption_enforcement_config]
}
main(...process.argv.slice(2));