---
title: "Public buckets and datasets in Terraform | Metacenta"
description: "How we spot Terraform that makes a bucket, dataset or database readable by anyone, which public bindings we skip, and when public data is intended."
url: "https://metacenta.com/rules/tf-public-access"
updated: "2026-10-14"
tokens: 587
---

Repository hygiene · rule tf-public-access

# Public buckets and datasets in Terraform

A Metacenta review checks this under the rule **No data store is public**. Everything below applies whether or not you ever commission one.

## What this rule checks

This rule flags any resource whose literal members or ACL make it readable by anyone: `allUsers`, `allAuthenticatedUsers`, `public-read` or `public-read-write`. It also flags `publicly_accessible = true`. A binding on an `invoker` role is skipped, because that makes an endpoint public, not data.

## Why it matters

If the resource holds anything but deliberately public data, that data is public now. Terraform restores the binding on the next apply, so removing it by hand in the console does not last.

## How to fix it

**Close public access to data stores.** Remove the public principal or ACL, and grant read access to named groups instead.

Before:

```hcl
resource "google_storage_bucket_iam_member" "exports" {
  bucket = var.exports_bucket
  role   = "roles/storage.objectViewer"
  member = "allUsers"
}
```

After:

```hcl
resource "google_storage_bucket_iam_member" "exports" {
  bucket = var.exports_bucket
  role   = "roles/storage.objectViewer"
  member = var.finance_readers
}
```

## When it is fine to leave

An open dataset published on purpose, such as public reference data, should be readable by anyone. Keep it in a resource of its own, named so the intent is plain. Tell us, and the finding comes out of your report.

## What we need to check it

The `.tf` files you supply, read for literal values only. A member or ACL set from a variable reads as unknown and is not flagged. We refuse `.tfvars` and state files by name.

[Ask about a review](https://metacenta.com/enquire?src=rule-tf-public-access&via=md)

## Related pages

- [Credential files committed to a data repository](https://metacenta.com/rules/repo-committed-credential-file)
- [Data repository with no CI pipeline](https://metacenta.com/rules/repo-no-ci)
- [Archived repositories under review](https://metacenta.com/rules/repo-archived)
- [Data repository with no tests](https://metacenta.com/rules/repo-no-tests)
- [A sample review, as a client reads it](https://metacenta.com/sample)
- [All published rules](https://metacenta.com/rules)
- [How a review is assessed](https://metacenta.com/standard)