## TL;DR
Remove the public member only after you know who actually needs the resource, because deleting allUsers blindly can break a genuinely shared integration. List every binding on the flagged resource, identify the role the public member holds, and check access logs or the resource owner for the real audience, usually a specific group, domain or service account. Replace the public member with that audience, verify the intended users still reach the resource, and confirm strangers cannot, then sweep the project for the same pattern on sibling resources.

```text
GCP IAM policy binding audit shows public access error: allUsers binding fix
```

## Use this when
- An audit flags a bucket, function, dataset or project with allUsers in a binding.
- The role granted publicly is stronger than viewer, raising the finding severity.
- The resource owner believed sharing was limited to their organization.

## Not for this skill when
- The resource is an approved public asset with a documented exception. Record it and monitor rather than removing access.
- The public access comes from a different layer, such as a load balancer or a signed URL practice. Fix that layer instead.

## Steps
1. Capture the flagged resource, the exact public member string and the role it holds from the audit finding, without changing anything yet. Verify: resource, member and role are recorded from the finding.
2. Ask the resource owner and check recent access logs where available to identify the real intended audience and any external dependency using the public access today. Verify: the intended audience and any live dependency are named.
3. Add the replacement binding for the intended audience first, using a group or domain member rather than individual users wherever possible, and confirm it appears in the policy. Verify: the replacement binding is present alongside the public one temporarily.
4. Test access as a member of the intended audience and as an unrelated account or unauthenticated request, proving the replacement works before the public member is removed. Verify: intended access works and unrelated access is ready to be cut.
5. Remove the allUsers or allAuthenticatedUsers member from the role, being careful to distinguish the two since authenticated users is still effectively public for many resources. Verify: the policy no longer contains a public member for that role.
6. Retest both access paths after removal and re-run the audit check for this resource to confirm the finding clears. Verify: the finding clears and intended access still works.
7. Sweep the project and folder for other resources with public members, listing each for owner review, and file the sweep with this fix in the review evidence. Verify: the sweep results are filed and every public binding has an owner decision pending or complete.

## Why it happens
Public bindings usually start as the fastest way to share something during development or to satisfy a tool that demanded broad access, and they survive because removing them feels riskier than leaving them. allAuthenticatedUsers is the subtler trap: it sounds like your organization and actually means anyone with an account on the platform. Replacing before removing keeps legitimate users working, and a project wide sweep matters because public sharing is a habit, and habits rarely produce exactly one resource.

## Variants and edge cases

### allUsers binding found on storage bucket audit
The bucket phrasing. Check object level and bucket level policies both; either can carry the public member.

### how to remove public access without breaking shared dataset
The cautious phrasing. Audience replacement and two sided testing are the safeguards that make removal safe.

### allAuthenticatedUsers is not organization only
The misconception phrasing. Any external account counts as authenticated, so treat the finding with the same urgency as allUsers.

Edge cases to check before closing the review cycle:
- Some services expose separate public switches outside IAM, such as allUsers style defaults on new resources. Set organization policy constraints to prevent recurrence.
- A public binding at project level inherits everywhere. Fix the highest level occurrence first, then recheck resources.
- Signed URLs and public websites served from a resource are design choices to document, not bindings to delete silently.

Compatibility: Google Cloud IAM policy bindings for projects, buckets, datasets and functions, organization policy constraints for public access prevention.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_aKH58VM6T8jzftgJdYpXxw