A Public Website Bucket That Does Not Publish Its File List
A Cloud Storage bucket serving a static website. Google's own guide notes that objectViewer lets anyone list the bucket, so this module grants legacyObjectReader: read a named file, list nothing. It says plainly that Cloud Storage does not serve your domain over HTTPS, requires you to accept that everything in it is public, and keeps trimmed previous versions as the rollback.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-16 · how we verify
Use it from the registry
terraform · opentofumodule "static_site" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-static-site/gcp"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
gcp-static-site
A static website bucket on Google Cloud Storage. Works with Terraform and OpenTofu
(>= 1.6), google provider >= 7.0, < 8.0.
objectViewer publishes the file list. Google's static-website guide says roles/storage.objectViewer includes listing the bucket. The module grants roles/storage.legacyObjectReader to allUsers instead: read an object you can name, list nothing.
Cloud Storage does not serve your domain over HTTPS, by Google's own statement. Put a load balancer in front (gcp-cloud-cdn takes this bucket as its backend); serves_https says false.
Everything in this bucket is public. accept_public_content must be set before the module builds it.
An organisation policy can refuse the public binding - enforced public access prevention or domain-restricted sharing - with an error that names neither. Neither policy is managed here.
Versioning is on, and old versions are trimmed by a lifecycle rule, so every deploy keeps a rollback without growing the bill forever.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
gcp-cloud-function
Event-driven or HTTP gen2 function with source upload, dedicated runtime SA and Eventarc trigger wiring.
gcp-cloud-run-job
A Cloud Run v2 Job for batch and run-to-completion workloads with a dedicated runtime service account, auto-wired Secret Manager accessor grants, VPC egress, bounded retries and per-task timeout.
gcp-cloud-run-service
Cloud Run v2 service with autoscaling, secret and VPC egress wiring, custom domain and invoker IAM done right.
gcp-app-engine
The application cannot be deleted and its region cannot be changed - destroy removes it from state and nothing else - and the region pins Firestore for the project. Without IAP every service is public on its appspot hostname. The permanent region must be accepted by name, IAP fronts every service unless public is stated, and a disabled serving status is a choice rather than an accident.
cloudflare-pages-project
Every branch pushed gets a public preview URL by default, the half-finished pricing page included; an environment variable is readable in the dashboard unless stored as a secret; and the production branch is whatever the repository's default was. Previews limited to the branches you list (every branch by name), each variable marked secret or plain, bindings per environment, and custom domains.
tencent-static-site
A COS bucket serving a static website. The public-read ACL that makes the objects readable also lets anyone list the bucket, and file_list_is_public says so; pass a bucket policy to publish the objects alone. redirect_all_requests_to on COS is a protocol rather than a hostname, which is why it is not exposed here.