A cloud security administrator needs to transition an enterprise Cloud Storage bucket containing financial audit data from legacy Access Control Lists (ACLs) to Uniform Bucket-Level Access. To ensure zero service disruption for automated workloads accessing the objects, what is the correct sequence of steps the administrator should execute?
- 1Audit existing object ACL permissions and Cloud Audit Logs to identify all user and service account access requirements.
- 2Grant equivalent predefined IAM roles (such as Storage Object Viewer or Storage Object Admin) at the bucket level to the identified principals.
- 3Enable Uniform Bucket-Level Access on the Cloud Storage bucket using gcloud storage or the GCP Console.
- 4Verify application workflows and review Cloud Audit Logs to confirm all object requests succeed under bucket-level IAM policies.
Answer
The correct sequence is: (1) Audit existing object ACL permissions and logs, (2) Grant equivalent predefined IAM roles at the bucket level, (3) Enable Uniform Bucket-Level Access on the bucket, and (4) Verify application workflows and monitor audit logs.
When transitioning a Cloud Storage bucket from fine-grained ACLs to Uniform Bucket-Level Access, you must first inspect current ACL usage to know which users require access. Second, you must grant those users equivalent bucket-level IAM roles (such as Storage Object Viewer or Creator) so their permissions remain valid under IAM. Third, you enable Uniform Bucket-Level Access on the bucket, which ignores ACLs and enforces IAM rules uniformly. Finally, you verify that all applications can still successfully access the bucket objects.
Step-by-Step Solution
Key Concept
Transitioning a bucket to Uniform Bucket-Level Access requires mapping ACL permissions to equivalent bucket-level IAM roles prior to enabling UBLA to prevent access disruption.