Google Cloud Storage Bucket Architect

import (
    "context"

    "cloud.google.com/go/storage"
)

// ...
ctx := context.Background()
client, err := storage.NewClient(ctx)

import (
    "context"
    "time"

    "cloud.google.com/go/storage"
)

func CreateSecureBucket(ctx context.Context, client *storage.Client, projectID, bucketName string) (*storage.BucketAttrs, error) {
    bucket := client.Bucket(bucketName)
    attrs := &storage.BucketAttrs{
        Location:      "us-east1",
        StorageClass:  "STANDARD",
        UniformBucketLevelAccess: storage.UniformBucketLevelAccess{
            Enabled: true,
        },
        PublicAccessPrevention: storage.PublicAccessPreventionEnforced,
        CustomerSuppliedEncryptionEnforcementConfig: &storage.EncryptionEnforcementConfig{
            RestrictionMode: storage.FullyRestricted,
        },
        SoftDeletePolicy: &storage.SoftDeletePolicy{
            RetentionDuration: 7 * 24 * time.Hour,
        },
    }
    if err := bucket.Create(ctx, projectID, attrs); err != nil {
        return nil, err
    }
    return bucket.Attrs(ctx)
}

import (
    "context"
    "time"

    "cloud.google.com/go/storage"
)

func CreateComplianceBucket(ctx context.Context, client *storage.Client, projectID, bucketName, kmsKeyID string) (*storage.BucketAttrs, error) {
    bucket := client.Bucket(bucketName)
    attrs := &storage.BucketAttrs{
        Location:      "us-central1",
        StorageClass:  "STANDARD",
        UniformBucketLevelAccess: storage.UniformBucketLevelAccess{
            Enabled: true,
        },
        PublicAccessPrevention: storage.PublicAccessPreventionEnforced,
        Encryption: &storage.BucketEncryption{
            DefaultKMSKeyName: kmsKeyID,
        },
        CustomerSuppliedEncryptionEnforcementConfig: &storage.EncryptionEnforcementConfig{
            RestrictionMode: storage.FullyRestricted,
        },
        // NOTE: IP Filtering is not supported via attributes in this Go client
        // library version. This must be configured using the REST API or gcloud.
        RetentionPolicy: &storage.RetentionPolicy{
            RetentionPeriod: 90 * 24 * time.Hour,
        },
        Autoclass: &storage.Autoclass{
            Enabled: true,
        },
        Labels: map[string]string{
            "data-class": "pii",
            "owner":      "security-team",
        },
        Lifecycle: storage.Lifecycle{
            Rules: []storage.LifecycleRule{
                {
                    Action: storage.LifecycleAction{
                        Type: "AbortIncompleteMultipartUpload",
                    },
                    Condition: storage.LifecycleCondition{
                        AgeInDays: 7,
                    },
                },
            },
        },
        SoftDeletePolicy: &storage.SoftDeletePolicy{
            RetentionDuration: 7 * 24 * time.Hour,
        },
    }
    if err := bucket.Create(ctx, projectID, attrs); err != nil {
        return nil, err
    }
    return bucket.Attrs(ctx)
}

import (
    "context"
    "time"

    "cloud.google.com/go/iam"
    "cloud.google.com/go/storage"
)

func CreateStaticWebsiteBucket(ctx context.Context, client *storage.Client, projectID, bucketName string) (*storage.BucketAttrs, error) {
    bucket := client.Bucket(bucketName)
    attrs := &storage.BucketAttrs{
        Location:      "US",
        StorageClass:  "STANDARD",
        UniformBucketLevelAccess: storage.UniformBucketLevelAccess{
            Enabled: true,
        },
        PublicAccessPrevention: storage.PublicAccessPreventionInherited,
        VersioningEnabled: true,
        SoftDeletePolicy: &storage.SoftDeletePolicy{
            RetentionDuration: 7 * 24 * time.Hour,
        },
        Website: &storage.BucketWebsite{
            MainPageSuffix: "index.html",
            NotFoundPage:   "404.html",
        },
        CORS: []storage.CORS{{
            MaxAge:          3600 * time.Second,
            Methods:         []string{"GET", "HEAD", "OPTIONS"},
            Origins:         []string{"*"},
            ResponseHeaders: []string{"Content-Type"},
        }},
    }
    if err := bucket.Create(ctx, projectID, attrs); err != nil {
        return nil, err
    }

    // Grant public access
    iamHandle := bucket.IAM()
    policy, err := iamHandle.Policy(ctx)
    if err != nil {
        return nil, err
    }
    policy.Add(iam.AllUsers, "roles/storage.objectViewer")
    if err := iamHandle.SetPolicy(ctx, policy); err != nil {
        return nil, err
    }
    return bucket.Attrs(ctx)
}

import (
    "context"
    "time"

    "cloud.google.com/go/storage"
)

func CreateCheckpointBucket(ctx context.Context, client *storage.Client, projectID, bucketName string) (*storage.BucketAttrs, error) {
    bucket := client.Bucket(bucketName)
    attrs := &storage.BucketAttrs{
        Location:      "us-east1",
        StorageClass:  "RAPID",
        UniformBucketLevelAccess: storage.UniformBucketLevelAccess{
            Enabled: true,
        },
        PublicAccessPrevention: storage.PublicAccessPreventionEnforced,
        CustomPlacementConfig: &storage.CustomPlacementConfig{
            DataLocations: []string{"us-east1-b"},
        },
        HierarchicalNamespace: &storage.HierarchicalNamespace{
            Enabled: true,
        },
        Lifecycle: storage.Lifecycle{
            Rules: []storage.LifecycleRule{
                {
                    Action: storage.LifecycleAction{
                        Type: "Delete",
                    },
                    Condition: storage.LifecycleCondition{
                        AgeInDays: 14,
                    },
                },
            },
        },
        SoftDeletePolicy: &storage.SoftDeletePolicy{
            RetentionDuration: 0,
        },
    }
    if err := bucket.Create(ctx, projectID, attrs); err != nil {
        return nil, err
    }
    return bucket.Attrs(ctx)
}

import (
    "context"
    "time"

    "cloud.google.com/go/storage"
)

func CreateRegulatoryWormBucket(ctx context.Context, client *storage.Client, projectID, bucketName, kmsKeyID string) (*storage.BucketAttrs, error) {
    // 1. Enable Object Retention on the BucketHandle before creating
    bucket := client.Bucket(bucketName).SetObjectRetention(true)

    // 2. Configure bucket attributes
    attrs := &storage.BucketAttrs{
        Location:      "us-east1",
        StorageClass:  "ARCHIVE",
        UniformBucketLevelAccess: storage.UniformBucketLevelAccess{
            Enabled: true,
        },
        PublicAccessPrevention: storage.PublicAccessPreventionEnforced,
        Encryption: &storage.BucketEncryption{
            DefaultKMSKeyName: kmsKeyID,
        },
        Labels: map[string]string{
            "compliance-type":  "regulatory",
            "retention-period": "7y",
        },
        SoftDeletePolicy: &storage.SoftDeletePolicy{
            RetentionDuration: 7 * 24 * time.Hour,
        },
        Lifecycle: storage.Lifecycle{
            Rules: []storage.LifecycleRule{
                {
                    Action: storage.LifecycleAction{
                        Type: "Delete",
                    },
                    Condition: storage.LifecycleCondition{
                        AgeInDays: 2555,
                    },
                },
            },
        },
    }

    if err := bucket.Create(ctx, projectID, attrs); err != nil {
        return nil, err
    }
    return bucket.Attrs(ctx)
}

func UploadObjectWithRetention(ctx context.Context, client *storage.Client, bucketName, objectName string) error {
    bucket := client.Bucket(bucketName)
    obj := bucket.Object(objectName)

    wc := obj.NewWriter(ctx)
    wc.ObjectAttrs.Retention = &storage.ObjectRetention{
        Mode:        "Locked",
        RetainUntil: time.Date(2030, 12, 31, 23, 59, 59, 0, time.UTC),
    }

    // Write object content
    if _, err := wc.Write([]byte("compliance data")); err != nil {
        wc.Close()
        return err
    }
    return wc.Close()
}