feat: add support for bucket encryption enforcement config by rajeevpodar · Pull Request #1742 · googleapis/python-storage

rajeevpodar · 2026-02-05T10:52:45Z

Implemented bucket encryption enforcement configuration support.
Added EncryptionEnforcementConfig and BucketEncryption classes.
Added encryption property to Bucket.
Added unit tests.

PR created automatically by Jules for task 10151670798613550332 started by @rajeevpodar

This change introduces support for configuring bucket encryption enforcement, including: - `defaultKmsKeyName` (via `BucketEncryption`) - `googleManagedEncryptionEnforcementConfig` - `customerManagedEncryptionEnforcementConfig` - `customerSuppliedEncryptionEnforcementConfig` New classes `EncryptionEnforcementConfig` and `BucketEncryption` are added to `google/cloud/storage/bucket.py` to wrap the API configuration. The `Bucket` class now exposes an `encryption` property. Tests are added in `tests/unit/test_bucket.py`. Co-authored-by: rajeevpodar <3637722+rajeevpodar@users.noreply.github.com>

google-labs-jules · 2026-02-05T10:52:47Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

gemini-code-assist · 2026-02-05T10:53:01Z

Summary of Changes

Hello @rajeevpodar, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the Google Cloud Storage client library by introducing robust support for managing bucket encryption enforcement configurations. It provides a structured API for users to define and apply various encryption policies, including setting restriction modes and handling different types of encryption (Google-managed, customer-managed, and customer-supplied) directly through the Bucket object. This feature allows for more granular control over data security and compliance within cloud storage buckets.

Highlights

New encryption property for Bucket: A new encryption property has been added to the Bucket class, allowing retrieval and setting of bucket-level encryption configurations.
Introduction of EncryptionEnforcementConfig class: A new class, EncryptionEnforcementConfig, has been introduced to represent and manage the restriction mode and effective time for encryption enforcement policies.
Introduction of BucketEncryption class: A new class, BucketEncryption, has been added to encapsulate the overall encryption configuration for a bucket, including the default KMS key name and specific enforcement configurations for Google-managed, customer-managed, and customer-supplied encryption.
New constants for encryption enforcement modes: Two new constants, ENFORCEMENT_MODE_FULLY_RESTRICTED and ENFORCEMENT_MODE_NOT_RESTRICTED, have been added to define bucket encryption restriction modes.
Comprehensive unit tests: Extensive unit tests have been added for the new encryption property on the Bucket class, as well as for the EncryptionEnforcementConfig and BucketEncryption classes, ensuring proper functionality and integration.

Changelog

google/cloud/storage/bucket.py
- Added encryption property (getter and setter) to the Bucket class.
- Introduced EncryptionEnforcementConfig class for managing encryption restriction modes and effective times.
- Introduced BucketEncryption class to manage default KMS keys and various encryption enforcement configurations.
google/cloud/storage/constants.py
- Added ENFORCEMENT_MODE_FULLY_RESTRICTED constant.
- Added ENFORCEMENT_MODE_NOT_RESTRICTED constant.
tests/unit/test_bucket.py
- Added unit tests for the Bucket.encryption property.
- Added a new test class Test_EncryptionEnforcementConfig with tests for its constructor, from_api_repr, and restriction_mode setter.
- Added a new test class Test_BucketEncryption with tests for its constructor, from_api_repr, and property setters that trigger _patch_property.

Activity

No human activity (comments, reviews, or progress updates) has been recorded for this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request adds support for bucket encryption enforcement configuration, introducing EncryptionEnforcementConfig and BucketEncryption classes and adding an encryption property to the Bucket class. The changes are well-structured and include corresponding unit tests. I have a few suggestions to improve code quality and test robustness.

google/cloud/storage/bucket.py

tests/unit/test_bucket.py

This change introduces support for configuring bucket encryption enforcement, including: - `defaultKmsKeyName` (via `BucketEncryption`) - `googleManagedEncryptionEnforcementConfig` - `customerManagedEncryptionEnforcementConfig` - `customerSuppliedEncryptionEnforcementConfig` New classes `EncryptionEnforcementConfig` and `BucketEncryption` are added to `google/cloud/storage/bucket.py` to wrap the API configuration. The `Bucket` class now exposes an `encryption` property. Tests are added in `tests/unit/test_bucket.py` and `tests/system/test_bucket.py`. Co-authored-by: rajeevpodar <3637722+rajeevpodar@users.noreply.github.com>

This change introduces support for configuring bucket encryption enforcement, including: - `defaultKmsKeyName` (via `BucketEncryption`) - `googleManagedEncryptionEnforcementConfig` - `customerManagedEncryptionEnforcementConfig` - `customerSuppliedEncryptionEnforcementConfig` New classes `EncryptionEnforcementConfig` and `BucketEncryption` are added to `google/cloud/storage/bucket.py` to wrap the API configuration. The `Bucket` class now exposes an `encryption` property. Tests are added in `tests/unit/test_bucket.py` and `tests/system/test_bucket.py`. Addressed review comments regarding kwargs handling, constants usage in tests, and null safety in getters. Co-authored-by: rajeevpodar <3637722+rajeevpodar@users.noreply.github.com>

This change introduces support for configuring bucket encryption enforcement, including: - `defaultKmsKeyName` (via `BucketEncryption`) - `googleManagedEncryptionEnforcementConfig` - `customerManagedEncryptionEnforcementConfig` - `customerSuppliedEncryptionEnforcementConfig` New classes `EncryptionEnforcementConfig` and `BucketEncryption` are added to `google/cloud/storage/bucket.py` to wrap the API configuration. The `Bucket` class now exposes an `encryption` property. Tests are added in `tests/unit/test_bucket.py` and `tests/system/test_bucket.py`. Addressed review comments: - Handling `**kw` in `EncryptionEnforcementConfig.__init__` for forward compatibility. - Using constants for restriction modes in tests. - Improving test robustness. - Formatting with black. Co-authored-by: rajeevpodar <3637722+rajeevpodar@users.noreply.github.com>

google/cloud/storage/constants.py

google/cloud/storage/bucket.py

tests/unit/test_bucket.py

tests/system/test_bucket.py

chalmerlowe · 2026-03-02T15:15:22Z

Migration Notice: This library is moving to the google-cloud-python monorepo soon.

We closed this PR due to inactivity to ensure a clean migration. Please re-open this work in the new monorepo once the migration is complete!

…550332

tests/system/test_bucket.py

…550332

tests/unit/test_bucket.py

google/cloud/storage/bucket.py

PR created by the Librarian CLI to initialize a release. Merging this PR will auto trigger a release. Librarian Version: v1.0.2-0.20251119154421-36c3e21ad3ac Language Image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:8e2c32496077054105bd06c54a59d6a6694287bc053588e24debe6da6920ad91 <details><summary>google-cloud-storage: 3.10.0</summary> ## [3.10.0](v3.9.0...v3.10.0) (2026-03-18) ### Features * [Bucket Encryption Enforcement] add support for bucket encryption enforcement config (#1742) ([2a6e8b0](2a6e8b0)) ### Perf Improvments * [Rapid Buckets Reads] Use raw proto access for read resumption strategy (#1764) ([14cfd61](14cfd61)) * [Rapid Buckets Benchmarks] init mp pool & grpc client once, use os.sched_setaffinity (#1751) ([a9eb82c](a9eb82c)) * [Rapid Buckets Writes] don't flush at every append, results in bad perf (#1746) ([ab62d72](ab62d72)) ### Bug Fixes * [Windows] skip downloading blobs whose name contain `":" ` eg: `C:` `D:` etc when application runs in Windows. (#1774) ([5581988](5581988)) * [Path Traversal] Prevent path traversal in `download_many_to_path` (#1768) ([700fec3](700fec3)) * [Rapid Buckets] pass token correctly, '&' instead of ',' (#1756) ([d8dd1e0](d8dd1e0)) </details>

rajeevpodar requested a review from a team as a code owner February 5, 2026 10:52

rajeevpodar requested a review from a team February 5, 2026 10:52

rajeevpodar requested a review from a team as a code owner February 5, 2026 10:52

product-auto-label bot added the size: l Pull request size is large. label Feb 5, 2026

blunderbuss-gcf bot assigned chandra-siri Feb 5, 2026

product-auto-label bot added the api: storage Issues related to the googleapis/python-storage API. label Feb 5, 2026

rajeevpodar marked this pull request as draft February 5, 2026 10:55

gemini-code-assist bot reviewed Feb 5, 2026

View reviewed changes

google/cloud/storage/bucket.py Outdated Show resolved Hide resolved

tests/unit/test_bucket.py Show resolved Hide resolved

tests/unit/test_bucket.py Show resolved Hide resolved

product-auto-label bot added size: xl Pull request size is extra large. and removed size: l Pull request size is large. labels Feb 5, 2026

google-labs-jules bot and others added 2 commits February 5, 2026 17:35

chandra-siri requested changes Feb 6, 2026

View reviewed changes

chalmerlowe closed this Mar 2, 2026

chandra-siri reopened this Mar 2, 2026

chore: fix tests

28b3e41

product-auto-label bot added size: l Pull request size is large. and removed size: xl Pull request size is extra large. labels Mar 12, 2026

nidhiii-27 added 4 commits March 12, 2026 07:29

Merge branch 'main' into feat/bucket-encryption-config-10151670798613…

e95b699

…550332

chore:resolve comments

66ab242

resolve build errors

0d03c96

formatting

3abe23d

nidhiii-27 marked this pull request as ready for review March 13, 2026 05:40

nidhiii-27 requested review from a team as code owners March 13, 2026 05:40

Merge branch 'main' into feat/bucket-encryption-config-10151670798613…

9589c17

…550332

chandra-siri requested changes Mar 16, 2026

View reviewed changes

tests/system/test_bucket.py Outdated Show resolved Hide resolved

tests/system/test_bucket.py Outdated Show resolved Hide resolved

nidhiii-27 added 3 commits March 16, 2026 08:49

review changes

b122fe7

add tests

1a15398

Merge branch 'main' into feat/bucket-encryption-config-10151670798613…

9e9dc21

…550332

chandra-siri approved these changes Mar 17, 2026

View reviewed changes

tests/unit/test_bucket.py Show resolved Hide resolved

tests/unit/test_bucket.py Show resolved Hide resolved

google/cloud/storage/bucket.py Outdated Show resolved Hide resolved

google/cloud/storage/bucket.py Show resolved Hide resolved

nidhiii-27 added 2 commits March 17, 2026 08:14

minor fixes

a203753

resolve tests

d65441f

nidhiii-27 merged commit 2a6e8b0 into main Mar 17, 2026
15 checks passed

nidhiii-27 deleted the feat/bucket-encryption-config-10151670798613550332 branch March 17, 2026 09:40

chandra-siri mentioned this pull request Mar 18, 2026

chore: librarian release pull request: 20260318T145147Z #1776

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add support for bucket encryption enforcement config#1742

feat: add support for bucket encryption enforcement config#1742
nidhiii-27 merged 15 commits intomainfrom
feat/bucket-encryption-config-10151670798613550332

rajeevpodar commented Feb 5, 2026

Uh oh!

google-labs-jules bot commented Feb 5, 2026

Uh oh!

gemini-code-assist bot commented Feb 5, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chalmerlowe commented Mar 2, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

rajeevpodar commented Feb 5, 2026

Uh oh!

google-labs-jules bot commented Feb 5, 2026

Uh oh!

gemini-code-assist bot commented Feb 5, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chalmerlowe commented Mar 2, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants