An enterprise cloud security architect is standardizing access controls on a Cloud Storage bucket named `enterprise-data-repository` by transitioning from legacy Access Control Lists (ACLs) to Uniform Bucket-Level Access (UBLA). Arrange the following administrative actions in the correct chronological sequence to complete this migration without causing access disruption for existing service accounts.
- 1Review Cloud Audit Logs to identify all users and service accounts accessing objects in the bucket via object-level ACLs.
- 2Grant equivalent IAM roles (such as Storage Object Viewer or Storage Object User) at the bucket level to the identified principals.
- 3Run `gcloud storage buckets update gs://enterprise-data-repository --uniform-bucket-level-access` to enable Uniform Bucket-Level Access.
- 4Verify bucket operations to ensure IAM access functions correctly and attempts to apply canned ACLs are rejected.
Answer
The correct sequence for transitioning to Uniform Bucket-Level Access is: 1) Identify ACL dependencies by reviewing Cloud Audit Logs; 2) Assign equivalent bucket-level IAM roles to affected principals; 3) Enable Uniform Bucket-Level Access using the gcloud storage tool; 4) Confirm that access operates strictly via IAM and ACL modification attempts are blocked.
The correct sequence ensures uninterrupted application access during a UBLA migration. First, inspecting audit logs identifies which accounts rely on object ACLs. Second, mapping those permissions to IAM roles at the bucket level guarantees access continuity. Third, enabling Uniform Bucket-Level Access via gcloud centralizes access control. Fourth, validating bucket behavior confirms that legacy ACL requests are properly rejected while IAM access functions as expected.
Step-by-Step Solution
Key Concept
Uniform Bucket-Level Access (UBLA) migration workflow and IAM role assignment