docs(storage): public access prevention examples

src/storage/examples/src/get_public_access_prevention.rs

@@ -0,0 +1,31 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// [START storage_get_public_access_prevention]
+use google_cloud_storage::client::StorageControl;
+
+pub async fn sample(client: &StorageControl, bucket_id: &str) -> anyhow::Result<()> {
+    let bucket = client
+        .get_bucket()
+        .set_name(format!("projects/_/buckets/{bucket_id}"))
+        .send()
+        .await?;
+    println!(
+        "Public access prevention is {:?} for bucket {}",
+        bucket.iam_config.map(|c| c.public_access_prevention),
+        bucket_id
+    );
+    Ok(())
+}
+// [END storage_get_public_access_prevention]

src/storage/examples/src/lib.rs

@@ -24,12 +24,16 @@ mod disable_default_event_based_hold;
 mod enable_default_event_based_hold;
 mod get_bucket_metadata;
 mod get_default_event_based_hold;
+mod get_public_access_prevention;
 mod list_buckets;
 mod objects;
 mod print_bucket_acl;
 mod print_bucket_acl_for_user;
 mod quickstart;
 mod remove_bucket_owner;
+mod set_public_access_prevention_enforced;
+mod set_public_access_prevention_inherited;
+mod set_public_access_prevention_unspecified;
 
 use google_cloud_storage::client::{Storage, StorageControl};
 use google_cloud_storage::model::Object;
@@ -67,6 +71,16 @@ pub async fn run_bucket_examples(buckets: &mut Vec<String>) -> anyhow::Result<()
     enable_default_event_based_hold::sample(&client, &id).await?;
     tracing::info!("running disable_default_event_based_hold example");
     disable_default_event_based_hold::sample(&client, &id).await?;
+    tracing::info!("running set_public_access_prevention_unspecified example");
+    set_public_access_prevention_unspecified::sample(&client, &id).await?;
+    tracing::info!("running set_public_access_prevention_inherited example");
+    set_public_access_prevention_inherited::sample(&client, &id).await?;
+    tracing::info!("running get_public_access_prevention example");
+    get_public_access_prevention::sample(&client, &id).await?;
+    tracing::info!("running set_public_access_prevention_enforced example");
+    set_public_access_prevention_enforced::sample(&client, &id).await?;
+    tracing::info!("running get_public_access_prevention example");
+    get_public_access_prevention::sample(&client, &id).await?;
     tracing::info!("running print_bucket_acl example");
     print_bucket_acl::sample(&client, &id).await?;
     tracing::info!("running add_bucket_owner example");

src/storage/examples/src/set_public_access_prevention_enforced.rs

@@ -0,0 +1,39 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// [START storage_set_public_access_prevention_enforced]
+use google_cloud_storage::client::StorageControl;
+use google_cloud_storage::model::bucket::IamConfig;
+use google_cloud_wkt::FieldMask;
+
+pub async fn sample(client: &StorageControl, bucket_id: &str) -> anyhow::Result<()> {
+    let bucket = client
+        .get_bucket()
+        .set_name(format!("projects/_/buckets/{bucket_id}"))
+        .send()
+        .await?;
+    let metageneration = bucket.metageneration;
+    let bucket = client
+        .update_bucket()
+        .set_bucket(
+            bucket.set_iam_config(IamConfig::new().set_public_access_prevention("enforced")),
+        )
+        .set_if_metageneration_match(metageneration)
+        .set_update_mask(FieldMask::default().set_paths(["iam_config.public_access_prevention"]))
+        .send()
+        .await?;
+    println!("Public access prevention is enforced for bucket {bucket_id}: {bucket:?}");
+    Ok(())
+}
+// [END storage_set_public_access_prevention_enforced]

src/storage/examples/src/set_public_access_prevention_inherited.rs

@@ -0,0 +1,39 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// [START storage_set_public_access_prevention_inherited]
+use google_cloud_storage::client::StorageControl;
+use google_cloud_storage::model::bucket::IamConfig;
+use google_cloud_wkt::FieldMask;
+
+pub async fn sample(client: &StorageControl, bucket_id: &str) -> anyhow::Result<()> {
+    let bucket = client
+        .get_bucket()
+        .set_name(format!("projects/_/buckets/{bucket_id}"))
+        .send()
+        .await?;
+    let metageneration = bucket.metageneration;
+    let bucket = client
+        .update_bucket()
+        .set_bucket(
+            bucket.set_iam_config(IamConfig::new().set_public_access_prevention("inherited")),
+        )
+        .set_if_metageneration_match(metageneration)
+        .set_update_mask(FieldMask::default().set_paths(["iam_config.public_access_prevention"]))
+        .send()
+        .await?;
+    println!("Public access prevention is inherited for bucket {bucket_id}: {bucket:?}");
+    Ok(())
+}
+// [END storage_set_public_access_prevention_inherited]

src/storage/examples/src/set_public_access_prevention_unspecified.rs

@@ -0,0 +1,37 @@
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// [START storage_set_public_access_prevention_unspecified]
+use google_cloud_storage::client::StorageControl;
+use google_cloud_storage::model::bucket::IamConfig;
+use google_cloud_wkt::FieldMask;
+
+pub async fn sample(client: &StorageControl, bucket_id: &str) -> anyhow::Result<()> {
+    let bucket = client
+        .get_bucket()
+        .set_name(format!("projects/_/buckets/{bucket_id}"))
+        .send()
+        .await?;
+    let metageneration = bucket.metageneration;
+    let bucket = client
+        .update_bucket()
+        .set_bucket(bucket.set_iam_config(IamConfig::new().set_public_access_prevention("")))
+        .set_if_metageneration_match(metageneration)
+        .set_update_mask(FieldMask::default().set_paths(["iam_config.public_access_prevention"]))
+        .send()
+        .await?;
+    println!("Public access prevention is unspecified for bucket {bucket_id}: {bucket:?}");
+    Ok(())
+}
+// [END storage_set_public_access_prevention_unspecified]