An infrastructure team is standardizing security controls on Google Cloud Storage buckets containing telemetry data. To comply with corporate audit standards, the team enables Uniform Bucket-Level Access (UBLA) on a bucket named telemetry-analytics-prod. Shortly after, an automated data ingestion process fails when executing a script that uploads log files with specific Access Control Lists (ACLs) using the Cloud Storage API. You need to resolve the error while maintaining UBLA compliance on the bucket. What should you do?
- Remove the object ACL parameters from the ingestion script and grant the ingestion service account the Storage Object Creator predefined IAM role on the bucket.Answer
- BDisable Uniform Bucket-Level Access on the bucket and re-apply fine-grained access control lists to the uploaded objects.
- CGrant the ingestion service account the primitive Owner role on the Google Cloud project to allow it to bypass UBLA restrictions.
- DGrant the ingestion service account object-level ACL permissions at the project level while keeping UBLA enabled on the bucket.
Answer
Remove the object ACL parameters from the ingestion script and grant the ingestion service account the Storage Object Creator predefined IAM role on the bucket.
When Uniform Bucket-Level Access is enabled on a Cloud Storage bucket, ACLs are completely disabled and access is strictly managed via Cloud IAM. The proper resolution is to update the application script to remove ACL parameters and assign the appropriate predefined Cloud IAM role (such as Storage Object Creator) to the principal.
Step-by-Step Solution
Key Concept
Uniform Bucket-Level Access (UBLA) disables legacy ACLs, requiring all access controls to be configured using Cloud IAM roles.