googleapis · Dhriti07 · Mar 24, 2026 · Oct 28, 2025 · Oct 30, 2025 · Oct 31, 2025
diff --git a/...ippets/src/main/java/com/example/storage/bucket/GetBucketEncryptionEnforcementConfig.java b/...ippets/src/main/java/com/example/storage/bucket/GetBucketEncryptionEnforcementConfig.java
@@ -0,0 +1,82 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.example.storage.bucket;
+
+// [START storage_get_bucket_encryption_enforcement_config]
+
+import com.google.cloud.storage.Bucket;
+import com.google.cloud.storage.BucketInfo.CustomerManagedEncryptionEnforcementConfig;
+import com.google.cloud.storage.BucketInfo.CustomerSuppliedEncryptionEnforcementConfig;
+import com.google.cloud.storage.BucketInfo.GoogleManagedEncryptionEnforcementConfig;
+import com.google.cloud.storage.Storage;
+import com.google.cloud.storage.StorageOptions;
+
+public class GetBucketEncryptionEnforcementConfig {
+  public static void getBucketEncryptionEnforcementConfig(String projectId, String bucketName)
+      throws Exception {
+    // The ID of your GCP project
+    // String projectId = "your-project-id";
+
+    // The ID of your GCS bucket
+    // String bucketName = "your-unique-bucket-name";
+
+    try (Storage storage =
+        StorageOptions.newBuilder().setProjectId(projectId).build().getService()) {
+      System.out.println(
+          "\n--- Getting Encryption Enforcement Policy for bucket " + bucketName + " ---");
+
+      Bucket bucket = storage.get(bucketName);
+
+      if (bucket == null) {
+        System.out.println("Bucket " + bucketName + " not found.");
+        return;
+      }
+
+      System.out.println("Bucket Name: " + bucket.getName());
+
+      GoogleManagedEncryptionEnforcementConfig gmekConfig =
+          bucket.getGoogleManagedEncryptionEnforcementConfig();
+      CustomerManagedEncryptionEnforcementConfig cmekConfig =
+          bucket.getCustomerManagedEncryptionEnforcementConfig();
+      CustomerSuppliedEncryptionEnforcementConfig csekConfig =
+          bucket.getCustomerSuppliedEncryptionEnforcementConfig();
+
+      System.out.println(
+          "  GMEK Enforcement: "
+              + (gmekConfig != null
+                  ? String.format(
+                      "Mode: %s, Effective Time: %s",
+                      gmekConfig.getRestrictionMode(), gmekConfig.getEffectiveTime())
+                  : "NOT SET (Default)"));
+      System.out.println(
+          "  CMEK Enforcement: "
+              + (cmekConfig != null
+                  ? String.format(
+                      "Mode: %s, Effective Time: %s",
+                      cmekConfig.getRestrictionMode(), cmekConfig.getEffectiveTime())
+                  : "NOT SET (Default)"));
+      System.out.println(
+          "  CSEK Enforcement: "
+              + (csekConfig != null
+                  ? String.format(
+                      "Mode: %s, Effective Time: %s",
+                      csekConfig.getRestrictionMode(), csekConfig.getEffectiveTime())
+                  : "NOT SET (Default)"));
+    }
+  }
+}
+// [END storage_get_bucket_encryption_enforcement_config]
diff --git a/...ippets/src/main/java/com/example/storage/bucket/SetBucketEncryptionEnforcementConfig.java b/...ippets/src/main/java/com/example/storage/bucket/SetBucketEncryptionEnforcementConfig.java
@@ -0,0 +1,113 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.example.storage.bucket;
+
+// [START storage_set_bucket_encryption_enforcement_config]
+
+import com.google.cloud.storage.Bucket;
+import com.google.cloud.storage.BucketInfo;
+import com.google.cloud.storage.BucketInfo.CustomerManagedEncryptionEnforcementConfig;
+import com.google.cloud.storage.BucketInfo.CustomerSuppliedEncryptionEnforcementConfig;
+import com.google.cloud.storage.BucketInfo.EncryptionEnforcementRestrictionMode;
+import com.google.cloud.storage.BucketInfo.GoogleManagedEncryptionEnforcementConfig;
+import com.google.cloud.storage.Storage;
+import com.google.cloud.storage.StorageOptions;
+
+public class SetBucketEncryptionEnforcementConfig {
+  public static void setBucketEncryptionEnforcementConfig(String projectId, String bucketName)
+      throws Exception {
+    // The ID of your GCP project
+    // String projectId = "your-project-id";
+
+    // The ID of your GCS bucket
+    // String bucketName = "your-unique-bucket-name";
+
+    try (Storage storage =
+        StorageOptions.newBuilder().setProjectId(projectId).build().getService()) {
+
+      // Example 1: Enforce GMEK Only
+      setGmekEnforcedPolicy(storage, "g-" + bucketName);
+
+      // Example 2: Enforce CMEK Only
+      setCmekEnforcedPolicy(storage, "c-" + bucketName);
+
+      // Example 3: Restrict CSEK (Ransomware Protection)
+      restrictCsekPolicy(storage, "rc-" + bucketName);
+    }
+  }
+
+  public static void setGmekEnforcedPolicy(Storage storage, String bucketName) {
+    GoogleManagedEncryptionEnforcementConfig gmekConfig =
+        GoogleManagedEncryptionEnforcementConfig.of(
+            EncryptionEnforcementRestrictionMode.NOT_RESTRICTED);
+    CustomerManagedEncryptionEnforcementConfig cmekConfig =
+        CustomerManagedEncryptionEnforcementConfig.of(
+            EncryptionEnforcementRestrictionMode.FULLY_RESTRICTED);
+    CustomerSuppliedEncryptionEnforcementConfig csekConfig =
+        CustomerSuppliedEncryptionEnforcementConfig.of(
+            EncryptionEnforcementRestrictionMode.FULLY_RESTRICTED);
+
+    BucketInfo bucketInfo =
+        BucketInfo.newBuilder(bucketName)
+            .setGoogleManagedEncryptionEnforcementConfig(gmekConfig)
+            .setCustomerManagedEncryptionEnforcementConfig(cmekConfig)
+            .setCustomerSuppliedEncryptionEnforcementConfig(csekConfig)
+            .build();
+
+    Bucket bucket = storage.create(bucketInfo);
+    System.out.println(
+        "Bucket " + bucket.getName() + " created with GMEK-only enforcement policy.");
+  }
+
+  public static void setCmekEnforcedPolicy(Storage storage, String bucketName) {
+    GoogleManagedEncryptionEnforcementConfig gmekConfig =
+        GoogleManagedEncryptionEnforcementConfig.of(
+            EncryptionEnforcementRestrictionMode.FULLY_RESTRICTED);
+    CustomerManagedEncryptionEnforcementConfig cmekConfig =
+        CustomerManagedEncryptionEnforcementConfig.of(
+            EncryptionEnforcementRestrictionMode.NOT_RESTRICTED);
+    CustomerSuppliedEncryptionEnforcementConfig csekConfig =
+        CustomerSuppliedEncryptionEnforcementConfig.of(
+            EncryptionEnforcementRestrictionMode.FULLY_RESTRICTED);
+
+    BucketInfo bucketInfo =
+        BucketInfo.newBuilder(bucketName)
+            .setGoogleManagedEncryptionEnforcementConfig(gmekConfig)
+            .setCustomerManagedEncryptionEnforcementConfig(cmekConfig)
+            .setCustomerSuppliedEncryptionEnforcementConfig(csekConfig)
+            .build();
+
+    Bucket bucket = storage.create(bucketInfo);
+    System.out.println(
+        "Bucket " + bucket.getName() + " created with CMEK-only enforcement policy.");
+  }
+
+  public static void restrictCsekPolicy(Storage storage, String bucketName) {
+    CustomerSuppliedEncryptionEnforcementConfig csekConfig =
+        CustomerSuppliedEncryptionEnforcementConfig.of(
+            EncryptionEnforcementRestrictionMode.FULLY_RESTRICTED);
+
+    BucketInfo bucketInfo =
+        BucketInfo.newBuilder(bucketName)
+            .setCustomerSuppliedEncryptionEnforcementConfig(csekConfig)
+            .build();
+
+    Bucket bucket = storage.create(bucketInfo);
+    System.out.println("Bucket " + bucket.getName() + " created with a policy to restrict CSEK.");
+  }
+}
+// [END storage_set_bucket_encryption_enforcement_config]
diff --git a/...ets/src/main/java/com/example/storage/bucket/UpdateBucketEncryptionEnforcementConfig.java b/...ets/src/main/java/com/example/storage/bucket/UpdateBucketEncryptionEnforcementConfig.java
@@ -0,0 +1,74 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.example.storage.bucket;
+
+// [START storage_update_bucket_encryption_enforcement_config]
+
+import com.google.cloud.storage.Bucket;
+import com.google.cloud.storage.BucketInfo.CustomerManagedEncryptionEnforcementConfig;
+import com.google.cloud.storage.BucketInfo.CustomerSuppliedEncryptionEnforcementConfig;
+import com.google.cloud.storage.BucketInfo.EncryptionEnforcementRestrictionMode;
+import com.google.cloud.storage.BucketInfo.GoogleManagedEncryptionEnforcementConfig;
+import com.google.cloud.storage.Storage;
+import com.google.cloud.storage.StorageOptions;
+
+public class UpdateBucketEncryptionEnforcementConfig {
+  public static void updateBucketEncryptionEnforcementConfig(String projectId, String bucketName)
+      throws Exception {
+    // The ID of your GCP project
+    // String projectId = "your-project-id";
+
+    // The ID of your GCS bucket with CMEK and CSEK restricted
+    // String bucketName = "your-unique-bucket-name";
+
+    try (Storage storage =
+        StorageOptions.newBuilder().setProjectId(projectId).build().getService()) {
+
+      Bucket bucket = storage.get(bucketName);
+      if (bucket == null) {
+        System.out.println("Bucket " + bucketName + " not found.");
+        return;
+      }
+
+      // 1. Update a specific type (e.g., change GMEK to FULLY_RESTRICTED)
+      GoogleManagedEncryptionEnforcementConfig newGmekConfig =
+          GoogleManagedEncryptionEnforcementConfig.of(
+              EncryptionEnforcementRestrictionMode.FULLY_RESTRICTED);
+
+      // 2. Remove a specific type (e.g., remove CMEK enforcement)
+      CustomerManagedEncryptionEnforcementConfig newCmekConfig =
+          CustomerManagedEncryptionEnforcementConfig.of(
+              EncryptionEnforcementRestrictionMode.NOT_RESTRICTED);
+
+      // For the update, need to specify all three configs, so keeping this same as before
+      CustomerSuppliedEncryptionEnforcementConfig sameCsekConfig =
+          CustomerSuppliedEncryptionEnforcementConfig.of(
+              EncryptionEnforcementRestrictionMode.FULLY_RESTRICTED);
+
+      bucket.toBuilder()
+          .setGoogleManagedEncryptionEnforcementConfig(newGmekConfig)
+          .setCustomerManagedEncryptionEnforcementConfig(newCmekConfig)
+          .setCustomerSuppliedEncryptionEnforcementConfig(sameCsekConfig)
+          .build()
+          .update();
+
+      System.out.println("Encryption enforcement policy updated for bucket " + bucketName);
+      System.out.println("GMEK is now fully restricted, and CMEK enforcement has been removed.");
+    }
+  }
+}
+// [END storage_update_bucket_encryption_enforcement_config]