Glossary term
allUsers and allAuthenticatedUsers
Special IAM principals meaning anyone on the Internet (allUsers) or anyone signed in to a Google account (allAuthenticatedUsers). They make resources public.
allUsers and allAuthenticatedUsers are special IAM members. allUsers means anyone on the Internet, authenticated or not; allAuthenticatedUsers means anyone signed in with any Google account, which in practice is also the whole Internet.
Adding either to a bucket, dataset, Cloud Run service, function or image policy makes the resource public. The grant is recorded in Admin Activity logs as a bindingDeltas entry with action: ADD, but subsequent anonymous reads of public Cloud Storage objects are not tracked by Cloud Audit Logs, so investigators have to reason in exposure windows. Public access prevention on Cloud Storage blocks these grants.