feat: add createBucketWithIpFilter sample and update IP filtering utility scripts and tests

Author: thiyaguk09

storage/createBucketWithIpFilter.js

@@ -0,0 +1,57 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+'use strict';
+
+function main(bucketName = 'my-bucket', filterMode = 'Enabled') {
+  // [START storage_create_bucket_ip_filtering]
+  /**
+   * TODO(developer): Uncomment the following lines before running the sample.
+   */
+  // The ID of your GCS bucket
+  // const bucketName = 'your-unique-bucket-name';
+
+  // Toggle data filtering (e.g., 'Enabled' | 'Disabled')
+  // const filterMode = 'Enabled';
+
+  // Imports the Google Cloud client library
+  const {Storage} = require('@google-cloud/storage');
+
+  // Creates a client
+  const storage = new Storage();
+
+  async function createBucketWithIpFilter() {
+    const ipFilter = {
+      mode: filterMode,
+      publicNetworkSource: {
+        allowedIpCidrRanges: ['8.8.8.8/32'],
+      },
+      allowCrossOrgVpcs: false,
+      allowAllServiceAgentAccess: false,
+    };
+
+    const [bucket] = await storage.createBucket(bucketName, {
+      ipFilter: ipFilter,
+    });
+
+    console.log(
+      `Bucket ${bucket.name} created with IP filter mode ${bucket.metadata.ipFilter.mode}.`
+    );
+  }
+
+  createBucketWithIpFilter().catch(console.error);
+  // [END storage_create_bucket_ip_filtering]
+}
+
+main(...process.argv.slice(2));

storage/deleteBucketIpFilterRules.js

@@ -21,6 +21,8 @@ function main(bucketName = 'my-bucket', cidrToDelete = '8.8.8.8/32') {
    */
   // The ID of your GCS bucket
   // const bucketName = 'your-unique-bucket-name';
+
+  // Target IP address/CIDR block to remove
   // const cidrToDelete = '8.8.8.8/32';
 
   // Imports the Google Cloud client library
@@ -33,14 +35,25 @@ function main(bucketName = 'my-bucket', cidrToDelete = '8.8.8.8/32') {
     // Note: To delete specific rules, you fetch the existing config, filter out the rules, and update.
     const [metadata] = await storage.bucket(bucketName).getMetadata();
 
-    if (!metadata.ipFilter) {
-      console.log(`No IP Filter configuration found for bucket ${bucketName}.`);
+    if (!metadata.ipFilter || !metadata.ipFilter.publicNetworkSource) {
+      console.log(
+        `No IP Filter public network configuration found for bucket ${bucketName}.`
+      );
+      return;
+    }
+
+    const currentIpRanges =
+      metadata.ipFilter.publicNetworkSource.allowedIpCidrRanges || [];
+    if (!currentIpRanges.includes(cidrToDelete)) {
+      console.log(
+        `CIDR range ${cidrToDelete} not found in bucket ${bucketName}. No changes made.`
+      );
       return;
     }
 
-    const updatedIpRanges = (
-      metadata.ipFilter.publicNetworkSource?.allowedIpCidrRanges || []
-    ).filter(range => range !== cidrToDelete);
+    const updatedIpRanges = currentIpRanges.filter(
+      range => range !== cidrToDelete
+    );
 
     const updatedIpFilter = {
       ...metadata.ipFilter,

storage/enableBucketIpFilter.js

@@ -22,6 +22,9 @@ function main(bucketName = 'my-bucket', filterMode = 'Enabled') {
   // The ID of your GCS bucket
   // const bucketName = 'your-unique-bucket-name';
 
+  // Toggle data filtering (e.g., 'Enabled' | 'Disabled')
+  // const filterMode = 'Enabled';
+
   // Imports the Google Cloud client library
   const {Storage} = require('@google-cloud/storage');
 
@@ -34,7 +37,7 @@ function main(bucketName = 'my-bucket', filterMode = 'Enabled') {
     const [metadata] = await storage.bucket(bucketName).getMetadata();
     const existingIpFilter = metadata.ipFilter || {
       mode: filterMode,
-      publicNetworkSource: {allowedIpCidrRanges: ['0.0.0.0/0']},
+      publicNetworkSource: {allowedIpCidrRanges: []},
       allowCrossOrgVpcs: false,
       allowAllServiceAgentAccess: false,
     };

storage/listBucketIpFilters.js

@@ -14,19 +14,14 @@
 
 'use strict';
 
-function main(projectId = 'my-project-id') {
+function main() {
   // [START storage_list_buckets_ip_filtering]
-  /**
-   * TODO(developer): Uncomment the following lines before running the sample.
-   */
-  // The ID of the project to which the service account belongs
-  // const projectId = 'my-project-id';
 
   // Imports the Google Cloud client library
   const {Storage} = require('@google-cloud/storage');
 
   // Creates a client
-  const storage = new Storage({projectId});
+  const storage = new Storage();
 
   async function listBucketsIpFiltering() {
     const [buckets] = await storage.getBuckets();

storage/system-test/buckets.test.js

@@ -142,6 +142,17 @@ it('should update and then remove bucket encryption enforcement configuration',
   assert.ok(!metadata.encryption);
 });
 
+it('should create a bucket with IP filter', () => {
+  const newBucketName = `${samplesTestBucketPrefix}-c`;
+  const output = execSync(
+    `node createBucketWithIpFilter.js ${newBucketName} Disabled`
+  );
+  assert.include(
+    output,
+    `Bucket ${newBucketName} created with IP filter mode Disabled.`
+  );
+});
+
 it('should enable the bucket IP filter', () => {
   const output = execSync(
     `node enableBucketIpFilter.js ${bucketName} Disabled`
@@ -160,8 +171,7 @@ it('should get the bucket IP filter', () => {
 });
 
 it('should list the bucket IP filters', () => {
-  const projectId = process.env.GCLOUD_PROJECT;
-  const output = execSync(`node listBucketIpFilters.js ${projectId}`);
+  const output = execSync('node listBucketIpFilters.js');
   assert.include(output, `${bucketName}: IP Filter Mode - Disabled`);
   assert.include(output, 'Public Network Allowed IP Ranges:');
   assert.include(output, '- 8.8.8.8/32');
@@ -173,6 +183,7 @@ it('should delete specific bucket IP filter rules', () => {
     output,
     `Specific IP Filter rules deleted for bucket ${bucketName}.`
   );
+  assert.notInclude(output, '8.8.8.8/32');
 });
 
 it('should disable the bucket IP filter', () => {