samples(Storage): Add samples and tests for Bucket IP filter

[mahendra-google]

This PR introduces a set of code samples and corresponding tests for bucket IP filtering .

storage_enable_ip_filtering: Code to create or update IP filtering rules. It handles first-time initialization of the configuration block and appends unique public or VPC CIDR ranges safely without overwriting pre-existing rules.

storage_delete_ip_filtering_rules: Code to selectively remove specific CIDR blocks from PublicNetworkSource or remove specified VpcNetworkSources, ensuring that IP filtering remains active for other public CIDR ranges.

storage_disable_ip_filtering: Code to completely disable IP filtering on a targeted bucket.

storage_get_ip_filtering: Code to retrieve and log the current active IP rules and access flags for an existing bucket.

storage_list_buckets_ip_filtering : Code to iterate through all buckets , outputting a log of their names along with their respective IP filtering status.

[snippet-bot]

Here is the summary of changes.

You are about to add 5 region tags.

• storage/api/Storage.Samples/DeleteBucketIpFilter.cs:15, tag storage_delete_ip_filtering_rules
• storage/api/Storage.Samples/DisableBucketIpFilter.cs:15, tag storage_disable_ip_filtering
• storage/api/Storage.Samples/EnableBucketIpFilter.cs:15, tag storage_enable_ip_filtering
• storage/api/Storage.Samples/GetBucketIpFilter.cs:15, tag storage_get_ip_filtering
• storage/api/Storage.Samples/ListBucketsWithIpFilterStatus.cs:15, tag storage_list_buckets_ip_filtering

---

This comment is generated by snippet-bot.
If you find problems with this result, please file an issue at:
https://github.com/googleapis/repo-automation-bots/issues.
To update this comment, add snippet-bot:force-run label or use the checkbox below:

• Refresh this comment

[gemini-code-assist]

Code Review

This pull request introduces a suite of samples and tests for managing Google Cloud Storage bucket IP filtering, covering operations such as creation, updates, deletion, and bypass rules. The review feedback identifies several improvement opportunities: replacing hardcoded project IDs in tests and samples with dynamic values to ensure portability, optimizing the deletion logic to prevent unnecessary API calls when an IP range is missing, and adding a project ID parameter to the update sample for consistent resource name construction.

[gemini-code-assist]

The project ID storage-sdk-vendor is hardcoded in the VPC network path assertion. This will cause the test to fail in any environment where the project ID differs. Use _fixture.ProjectId to make the test portable.

            .FirstOrDefault(v => v.Network == $"projects/{_fixture.ProjectId}/global/networks/default");

[gemini-code-assist]

The code performs a bucket update and logs a success message even if the specified IP address was not found in the allowed ranges. It is better to check the return value of Remove() to avoid redundant API calls and provide accurate feedback to the user.

        if (bucket.IpFilter.PublicNetworkSource.AllowedIpCidrRanges.Remove(ipAddress))
        {
            storage.UpdateBucket(bucket);
            Console.WriteLine($"IP Address ({ipAddress}) from Allowed CIDR Ranges has been deleted from the bucket: {bucketName}");
        }
        else
        {
            Console.WriteLine($"IP Address ({ipAddress}) was not found in the Allowed CIDR Ranges for bucket: {bucketName}");
        }

[gemini-code-assist]

This sample should accept a projectId parameter to construct the VPC network resource name dynamically, rather than using a hardcoded placeholder like your-project. This ensures consistency with other samples in this pull request, such as CreateBucketWithIpFilterSample.

    public Bucket UpdateBucketIpFilter(string projectId = "your-project-id", string bucketName = "your-unique-bucket-name", string publicRange = "192.0.2.0/24",
        string vpcRange = "10.0.0.0/24")

[gemini-code-assist]

Use the projectId parameter to construct the network resource name instead of a hardcoded placeholder.

            string networkName = $"projects/{projectId}/global/networks/default";

[gemini-code-assist]

Pass the project ID from the fixture to the updated UpdateBucketIpFilter method.

        var updatedBucket = updateSample.UpdateBucketIpFilter(_fixture.ProjectId, bucketName, newPublicRange, newVpcRange);

[Rebel2169]

my buckets are supposed to be private

…

On Tue, May 19, 2026, 8:57 AM gemini-code-assist[bot] < ***@***.***> wrote: ***@***.***[bot]* commented on this pull request. Code Review This pull request introduces a suite of samples and tests for managing Google Cloud Storage bucket IP filtering, covering operations such as creation, updates, deletion, and bypass rules. The review feedback identifies several improvement opportunities: replacing hardcoded project IDs in tests and samples with dynamic values to ensure portability, optimizing the deletion logic to prevent unnecessary API calls when an IP range is missing, and adding a project ID parameter to the update sample for consistent resource name construction. ------------------------------ In storage/api/Storage.Samples.Tests/UpdateBucketIpFilterTest.cs <#3334 (comment)> : > + [Fact] + public void TestUpdateBucketIpFilter() + { + var updateSample = new UpdateBucketIpFilterSample(); + var bucketName = _fixture.GenerateBucketName(); + string newPublicRange = "192.0.2.0/24"; + string newVpcRange = "10.0.0.0/24"; + _fixture.CreateBucket(bucketName, multiVersion: false, ipFilter: true, registerForDeletion: true); + var updatedBucket = updateSample.UpdateBucketIpFilter(bucketName, newPublicRange, newVpcRange); + Assert.NotNull(updatedBucket.IpFilter); + Assert.Equal("Disabled", updatedBucket.IpFilter.Mode); + var publicRanges = updatedBucket.IpFilter.PublicNetworkSource?.AllowedIpCidrRanges; + Assert.NotNull(publicRanges); + Assert.Contains(newPublicRange, publicRanges); + var vpcNetwork = updatedBucket.IpFilter.VpcNetworkSources? + .FirstOrDefault(v => v.Network == "projects/storage-sdk-vendor/global/networks/default"); [image: high] <https://camo.githubusercontent.com/7559374fd248a2a146dfe7112beda558979c4f6d02dbe7c5161fd893fe834423/68747470733a2f2f7777772e677374617469632e636f6d2f636f64657265766965776167656e742f686967682d7072696f726974792e737667> The project ID storage-sdk-vendor is hardcoded in the VPC network path assertion. This will cause the test to fail in any environment where the project ID differs. Use _fixture.ProjectId to make the test portable. .FirstOrDefault(v => v.Network == $"projects/{_fixture.ProjectId}/global/networks/default"); ------------------------------ In storage/api/Storage.Samples/DeleteBucketIpFilter.cs <#3334 (comment)> : > + bucket.IpFilter.PublicNetworkSource.AllowedIpCidrRanges.Remove(ipAddress); + storage.UpdateBucket(bucket); + Console.WriteLine($"IP Address ({ipAddress}) from Allowed CIDR Ranges has been deleted from the bucket: {bucketName}"); [image: medium] <https://camo.githubusercontent.com/32601710f6703a1d3cdbb05c7f9f05d1d8c88abc4d4e4d4e25ff218874a45279/68747470733a2f2f7777772e677374617469632e636f6d2f636f64657265766965776167656e742f6d656469756d2d7072696f726974792e737667> The code performs a bucket update and logs a success message even if the specified IP address was not found in the allowed ranges. It is better to check the return value of Remove() to avoid redundant API calls and provide accurate feedback to the user. if (bucket.IpFilter.PublicNetworkSource.AllowedIpCidrRanges.Remove(ipAddress)) { storage.UpdateBucket(bucket); Console.WriteLine($"IP Address ({ipAddress}) from Allowed CIDR Ranges has been deleted from the bucket: {bucketName}"); } else { Console.WriteLine($"IP Address ({ipAddress}) was not found in the Allowed CIDR Ranges for bucket: {bucketName}"); } ------------------------------ In storage/api/Storage.Samples/UpdateBucketIpFilter.cs <#3334 (comment)> : > + public Bucket UpdateBucketIpFilter(string bucketName = "your-unique-bucket-name", string publicRange = "192.0.2.0/24", + string vpcRange = "10.0.0.0/24") [image: medium] <https://camo.githubusercontent.com/32601710f6703a1d3cdbb05c7f9f05d1d8c88abc4d4e4d4e25ff218874a45279/68747470733a2f2f7777772e677374617469632e636f6d2f636f64657265766965776167656e742f6d656469756d2d7072696f726974792e737667> This sample should accept a projectId parameter to construct the VPC network resource name dynamically, rather than using a hardcoded placeholder like your-project. This ensures consistency with other samples in this pull request, such as CreateBucketWithIpFilterSample. public Bucket UpdateBucketIpFilter(string projectId = "your-project-id", string bucketName = "your-unique-bucket-name", string publicRange = "192.0.2.0/24", string vpcRange = "10.0.0.0/24") ------------------------------ In storage/api/Storage.Samples/UpdateBucketIpFilter.cs <#3334 (comment)> : > + bucket.IpFilter.VpcNetworkSources = new List<Bucket.IpFilterData.VpcNetworkSourcesData>(); + } + + var existingVpcNetwork = bucket.IpFilter.VpcNetworkSources.FirstOrDefault(); + + if (existingVpcNetwork != null) + { + if (existingVpcNetwork.AllowedIpCidrRanges == null) + { + existingVpcNetwork.AllowedIpCidrRanges = new List<string>(); + } + existingVpcNetwork.AllowedIpCidrRanges.Add(vpcRange); + } + else + { + string networkName = "projects/your-project/global/networks/default"; [image: medium] <https://camo.githubusercontent.com/32601710f6703a1d3cdbb05c7f9f05d1d8c88abc4d4e4d4e25ff218874a45279/68747470733a2f2f7777772e677374617469632e636f6d2f636f64657265766965776167656e742f6d656469756d2d7072696f726974792e737667> Use the projectId parameter to construct the network resource name instead of a hardcoded placeholder. string networkName = $"projects/{projectId}/global/networks/default"; ------------------------------ In storage/api/Storage.Samples.Tests/UpdateBucketIpFilterTest.cs <#3334 (comment)> : > + private readonly StorageFixture _fixture; + + public UpdateBucketIpFilterTest(StorageFixture fixture) + { + _fixture = fixture; + } + + [Fact] + public void TestUpdateBucketIpFilter() + { + var updateSample = new UpdateBucketIpFilterSample(); + var bucketName = _fixture.GenerateBucketName(); + string newPublicRange = "192.0.2.0/24"; + string newVpcRange = "10.0.0.0/24"; + _fixture.CreateBucket(bucketName, multiVersion: false, ipFilter: true, registerForDeletion: true); + var updatedBucket = updateSample.UpdateBucketIpFilter(bucketName, newPublicRange, newVpcRange); [image: medium] <https://camo.githubusercontent.com/32601710f6703a1d3cdbb05c7f9f05d1d8c88abc4d4e4d4e25ff218874a45279/68747470733a2f2f7777772e677374617469632e636f6d2f636f64657265766965776167656e742f6d656469756d2d7072696f726974792e737667> Pass the project ID from the fixture to the updated UpdateBucketIpFilter method. var updatedBucket = updateSample.UpdateBucketIpFilter(_fixture.ProjectId, bucketName, newPublicRange, newVpcRange); — Reply to this email directly, view it on GitHub <#3334 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BNPSYU6TRRKQG4FQVHNJ4ZL43RR6BAVCNFSM6AAAAACZENO2VSVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHM2DGMJZGYZTEMZQG4> . You are receiving this because you are subscribed to this thread.Message ID: <GoogleCloudPlatform/dotnet-docs-samples/pull/3334/review/4319632307@ github.com>

[mahendra-google]

my buckets are supposed to be private

Thanks for taking the time to review the code!

Could you please point me to the specific line of code where the buckets are private? I want to make sure I get that fixed and —keeping that data private is definitely a priority for our customers.

Appreciate the help!

[mahendra-google]

I have moved this PR to Draft mode for now. Based on the updates in issue #422766398 (comment 8), the backend tags for the Bucket IP Filter samples are not fully ready. I will mark this back as ready for review as soon as those tags are fixed.

[krishnamd-jkp]

If the bucket is updated with the IP, will the test later be able to delete the bucket? If not ,this will turn into a leak. Maybe pass '0.0.0.0/0' to allow the test to delete the bucket later?

[mahendra-google]

Passed 0.0.0.0/0 as the value for newPublicRange and newVpcRange in the EnableBucketIpFilter sample method call within EnableBucketIpFilterTest

[krishnamd-jkp]

Remove this retry as well. If the sample doesn't enable in the first try, just let the test fail to see what is happening.

[mahendra-google]

The retry loop is removed.