feat(storage): add bucket IP filtering samples and tests

java-storage/samples/snippets/src/main/java/com/example/storage/bucket/CreateBucketIpFilter.java

@@ -0,0 +1,57 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.example.storage.bucket;
+
+// [START storage_create_bucket_ip_filtering]
+import com.google.cloud.storage.Bucket;
+import com.google.cloud.storage.BucketInfo;
+import com.google.cloud.storage.BucketInfo.IpFilter;
+import com.google.cloud.storage.BucketInfo.IpFilter.PublicNetworkSource;
+import com.google.cloud.storage.Storage;
+import com.google.cloud.storage.StorageOptions;
+import java.util.Arrays;
+
+public class CreateBucketIpFilter {
+  public static void createBucketIpFilter(
+      String projectId, String bucketName, String publicCidrRange) {
+    // The ID of your GCP project
+    // String projectId = "your-project-id";
+
+    // The ID to give your GCS bucket
+    // String bucketName = "your-unique-bucket-name";
+
+    // The public IPv4 CIDR range to allow
+    // String publicCidrRange = "192.0.2.0/24";
+
+    Storage storage = StorageOptions.newBuilder().setProjectId(projectId).build().getService();
+
+    IpFilter ipFilter =
+        IpFilter.newBuilder()
+            .setMode("Disabled")
+            .setAllowAllServiceAgentAccess(true)
+            .setPublicNetworkSource(PublicNetworkSource.of(Arrays.asList(publicCidrRange)))
+            .build();
+
+    BucketInfo bucketInfo = BucketInfo.newBuilder(bucketName).setIpFilter(ipFilter).build();
+
+    Bucket bucket = storage.create(bucketInfo);
+
+    System.out.println(
+        "Created bucket " + bucketName + " with IP filter mode " + bucket.getIpFilter().getMode());
+  }
+}
+// [END storage_create_bucket_ip_filtering]

java-storage/samples/snippets/src/main/java/com/example/storage/bucket/DeleteBucketIpFilter.java

@@ -0,0 +1,95 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.example.storage.bucket;
+
+// [START storage_delete_ip_filtering_rules]
+import com.google.cloud.storage.Bucket;
+import com.google.cloud.storage.BucketInfo.IpFilter;
+import com.google.cloud.storage.BucketInfo.IpFilter.PublicNetworkSource;
+import com.google.cloud.storage.BucketInfo.IpFilter.VpcNetworkSource;
+import com.google.cloud.storage.Storage;
+import com.google.cloud.storage.StorageOptions;
+import java.util.ArrayList;
+import java.util.Iterator;
+import java.util.List;
+
+public class DeleteBucketIpFilter {
+  public static Bucket deleteBucketIpFilterRules(
+      String projectId, String bucketName, String publicRangeToDelete, String vpcNetworkToDelete) {
+    // The ID of your GCP project
+    // String projectId = "your-project-id";
+
+    // The ID of your GCS bucket
+    // String bucketName = "your-unique-bucket-name";
+
+    // The public IPv4/IPv6 CIDR range to remove
+    // String publicRangeToDelete = "192.0.2.0/24";
+
+    // The VPC network name to remove
+    // String vpcNetworkToDelete = "projects/my-project/global/networks/my-vpc";
+
+    Storage storage = StorageOptions.newBuilder().setProjectId(projectId).build().getService();
+    Bucket bucket = storage.get(bucketName);
+    IpFilter ipFilter = bucket.getIpFilter();
+
+    if (ipFilter == null) {
+      System.out.println("Bucket " + bucketName + " has no IP Filter configured.");
+      return bucket;
+    }
+
+    boolean modified = false;
+    List<String> publicRanges = new ArrayList<>();
+    if (ipFilter.getPublicNetworkSource() != null
+        && ipFilter.getPublicNetworkSource().getAllowedIpCidrRanges() != null) {
+      publicRanges.addAll(ipFilter.getPublicNetworkSource().getAllowedIpCidrRanges());
+    }
+    if (publicRangeToDelete != null && publicRanges.remove(publicRangeToDelete)) {
+      modified = true;
+    }
+
+    List<VpcNetworkSource> vpcSources = new ArrayList<>();
+    if (ipFilter.getVpcNetworkSources() != null) {
+      vpcSources.addAll(ipFilter.getVpcNetworkSources());
+    }
+    if (vpcNetworkToDelete != null) {
+      Iterator<VpcNetworkSource> iterator = vpcSources.iterator();
+      while (iterator.hasNext()) {
+        VpcNetworkSource source = iterator.next();
+        if (vpcNetworkToDelete.equals(source.getNetwork())) {
+          iterator.remove();
+          modified = true;
+        }
+      }
+    }
+
+    if (modified) {
+      IpFilter.Builder updatedIpFilterBuilder = ipFilter.toBuilder();
+      updatedIpFilterBuilder.setPublicNetworkSource(
+          publicRanges.isEmpty() ? null : PublicNetworkSource.of(publicRanges));
+      updatedIpFilterBuilder.setVpcNetworkSources(vpcSources.isEmpty() ? null : vpcSources);
+
+      Bucket updatedBucket =
+          storage.update(bucket.toBuilder().setIpFilter(updatedIpFilterBuilder.build()).build());
+      System.out.println("Deleted specified IP filtering rules for bucket " + bucketName);
+      return updatedBucket;
+    } else {
+      System.out.println("No matching IP filtering rules found to delete for bucket " + bucketName);
+      return bucket;
+    }
+  }
+}
+// [END storage_delete_ip_filtering_rules]

java-storage/samples/snippets/src/main/java/com/example/storage/bucket/DisableBucketIpFilter.java

@@ -0,0 +1,48 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.example.storage.bucket;
+
+// [START storage_disable_ip_filtering]
+import com.google.cloud.storage.Bucket;
+import com.google.cloud.storage.BucketInfo.IpFilter;
+import com.google.cloud.storage.Storage;
+import com.google.cloud.storage.StorageOptions;
+
+public class DisableBucketIpFilter {
+  public static Bucket disableBucketIpFilter(String projectId, String bucketName) {
+    // The ID of your GCP project
+    // String projectId = "your-project-id";
+
+    // The ID of your GCS bucket
+    // String bucketName = "your-unique-bucket-name";
+
+    Storage storage = StorageOptions.newBuilder().setProjectId(projectId).build().getService();
+    Bucket bucket = storage.get(bucketName);
+
+    if (bucket.getIpFilter() == null) {
+      System.out.println("Bucket " + bucketName + " has no IP Filter configured.");
+      return bucket;
+    }
+
+    IpFilter disabledIpFilter = bucket.getIpFilter().toBuilder().setMode("Disabled").build();
+    Bucket updatedBucket = storage.update(bucket.toBuilder().setIpFilter(disabledIpFilter).build());
+
+    System.out.println("IP filtering disabled for bucket " + bucketName);
+    return updatedBucket;
+  }
+}
+// [END storage_disable_ip_filtering]

java-storage/samples/snippets/src/main/java/com/example/storage/bucket/EnableBucketIpFilter.java

@@ -0,0 +1,126 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.example.storage.bucket;
+
+// [START storage_enable_ip_filtering]
+import com.google.cloud.storage.Bucket;
+import com.google.cloud.storage.BucketInfo.IpFilter;
+import com.google.cloud.storage.BucketInfo.IpFilter.PublicNetworkSource;
+import com.google.cloud.storage.BucketInfo.IpFilter.VpcNetworkSource;
+import com.google.cloud.storage.Storage;
+import com.google.cloud.storage.StorageOptions;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+public class EnableBucketIpFilter {
+  public static Bucket enableBucketIpFilter(
+      String projectId,
+      String bucketName,
+      String publicRange,
+      String vpcNetworkName,
+      String vpcRange) {
+    // The ID of your GCP project
+    // String projectId = "your-project-id";
+
+    // The ID of your GCS bucket
+    // String bucketName = "your-unique-bucket-name";
+
+    // The public IPv4/IPv6 CIDR range to allow
+    // String publicRange = "192.0.2.0/24";
+
+    // The VPC network name in the format: projects/PROJECT_ID/global/networks/NETWORK_NAME
+    // String vpcNetworkName = "projects/my-project/global/networks/my-vpc";
+
+    // The VPC IPv4/IPv6 CIDR range to allow
+    // String vpcRange = "10.0.0.0/24";
+
+    Storage storage = StorageOptions.newBuilder().setProjectId(projectId).build().getService();
+    Bucket bucket = storage.get(bucketName);
+
+    List<String> publicRanges = new ArrayList<>();
+    List<VpcNetworkSource> vpcSources = new ArrayList<>();
+
+    IpFilter existingIpFilter = bucket.getIpFilter();
+    if (existingIpFilter != null) {
+      if (existingIpFilter.getPublicNetworkSource() != null
+          && existingIpFilter.getPublicNetworkSource().getAllowedIpCidrRanges() != null) {
+        publicRanges.addAll(existingIpFilter.getPublicNetworkSource().getAllowedIpCidrRanges());
+      }
+      if (existingIpFilter.getVpcNetworkSources() != null) {
+        vpcSources.addAll(existingIpFilter.getVpcNetworkSources());
+      }
+    }
+
+    if (publicRange != null && !publicRanges.contains(publicRange)) {
+      publicRanges.add(publicRange);
+    }
+
+    if (vpcNetworkName != null && vpcRange != null) {
+      boolean found = false;
+      for (int i = 0; i < vpcSources.size(); i++) {
+        VpcNetworkSource vpcSource = vpcSources.get(i);
+        if (vpcNetworkName.equals(vpcSource.getNetwork())) {
+          found = true;
+          List<String> ranges = new ArrayList<>();
+          if (vpcSource.getAllowedIpCidrRanges() != null) {
+            ranges.addAll(vpcSource.getAllowedIpCidrRanges());
+          }
+          if (!ranges.contains(vpcRange)) {
+            ranges.add(vpcRange);
+          }
+          vpcSources.set(i, vpcSource.toBuilder().setAllowedIpCidrRanges(ranges).build());
+          break;
+        }
+      }
+      if (!found) {
+        vpcSources.add(
+            VpcNetworkSource.newBuilder()
+                .setNetwork(vpcNetworkName)
+                .setAllowedIpCidrRanges(Collections.singletonList(vpcRange))
+                .build());
+      }
+    }
+
+    IpFilter.Builder ipFilterBuilder =
+        IpFilter.newBuilder()
+            .setMode("Enabled")
+            .setAllowAllServiceAgentAccess(true)
+            .setAllowCrossOrgVpcs(true);
+
+    if (!publicRanges.isEmpty()) {
+      ipFilterBuilder.setPublicNetworkSource(PublicNetworkSource.of(publicRanges));
+    }
+    if (!vpcSources.isEmpty()) {
+      ipFilterBuilder.setVpcNetworkSources(vpcSources);
+    }
+
+    IpFilter newIpFilter = ipFilterBuilder.build();
+    Bucket updatedBucket = storage.update(bucket.toBuilder().setIpFilter(newIpFilter).build());
+
+    System.out.println(
+        "Enabled IP filtering for bucket "
+            + bucketName
+            + ", allowed public CIDRs: "
+            + publicRanges
+            + ", VPC sources: "
+            + vpcSources);
+
+    return updatedBucket;
+  }
+}
+// [END storage_enable_ip_filtering]

java-storage/samples/snippets/src/main/java/com/example/storage/bucket/GetBucketIpFilter.java

@@ -0,0 +1,67 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.example.storage.bucket;
+
+// [START storage_get_ip_filtering]
+import com.google.cloud.storage.Bucket;
+import com.google.cloud.storage.BucketInfo.IpFilter;
+import com.google.cloud.storage.BucketInfo.IpFilter.VpcNetworkSource;
+import com.google.cloud.storage.Storage;
+import com.google.cloud.storage.StorageOptions;
+
+public class GetBucketIpFilter {
+  public static IpFilter getBucketIpFilter(String projectId, String bucketName) {
+    // The ID of your GCP project
+    // String projectId = "your-project-id";
+
+    // The ID of your GCS bucket
+    // String bucketName = "your-unique-bucket-name";
+
+    Storage storage = StorageOptions.newBuilder().setProjectId(projectId).build().getService();
+    Bucket bucket = storage.get(bucketName);
+    IpFilter ipFilter = bucket.getIpFilter();
+
+    if (ipFilter == null) {
+      System.out.println("Bucket " + bucketName + " has no IP Filter configured.");
+      return null;
+    }
+
+    System.out.println("IP Filter Mode: " + ipFilter.getMode());
+    System.out.println(
+        "Allow All Service Agent Access: " + ipFilter.getAllowAllServiceAgentAccess());
+    System.out.println("Allow Cross Org VPCs: " + ipFilter.getAllowCrossOrgVpcs());
+
+    if (ipFilter.getPublicNetworkSource() != null) {
+      System.out.println(
+          "Allowed Public CIDR Blocks: "
+              + ipFilter.getPublicNetworkSource().getAllowedIpCidrRanges());
+    }
+
+    if (ipFilter.getVpcNetworkSources() != null) {
+      for (VpcNetworkSource vpcSource : ipFilter.getVpcNetworkSources()) {
+        System.out.println(
+            "VPC Network: "
+                + vpcSource.getNetwork()
+                + ", Allowed CIDR Ranges: "
+                + vpcSource.getAllowedIpCidrRanges());
+      }
+    }
+
+    return ipFilter;
+  }
+}
+// [END storage_get_ip_filtering]