Examkin

Question

Difficulty: HardConfiguring Storage Access Controls and Uniform Bucket-Level Access

A data engineering team configures an automated script running on a Compute Engine instance to upload daily transaction logs to a Cloud Storage bucket named `fintech-settlements-prod`. To satisfy regulatory compliance, the security team has already enabled Uniform Bucket-Level Access on `fintech-settlements-prod`. During initial testing, the script fails with a HTTP 400 Bad Request error stating that ACLs cannot be set because Uniform Bucket-Level Access is enabled. Inspection of the script reveals it invokes `gcloud storage cp` with the flag `--predefined-acl=bucket-owner-full-control`. How should the team modify the workflow to resolve the upload failure while preserving compliance standards?

  1. A
    Disable Uniform Bucket-Level Access on `fintech-settlements-prod` to allow the script to apply fine-grained object ACL flags during the upload operation.
  2. Remove the `--predefined-acl` flag from the script command and grant the instance service account the predefined `roles/storage.objectCreator` role on the bucket using Cloud IAM.Answer
  3. C
    Grant the service account the primitive `roles/owner` role at the project level while keeping the `--predefined-acl` flag in the script.
  4. D
    Create an object-level ACL grant explicitly at the destination prefix in Cloud Storage to override project-level IAM policies.

Answer

Remove the predefined ACL flag from the upload script and grant the service account the predefined Storage Object Creator IAM role on the bucket.
Enabling Uniform Bucket-Level Access (UBLA) on a Google Cloud Storage bucket disables legacy Access Control Lists (ACLs) entirely. Consequently, any operations attempting to set ACLs (such as passing the `--predefined-acl` flag in `gcloud storage cp`) will fail. To resolve this error while preserving compliance, the script must stop specifying ACL flags, and write permissions must be granted exclusively via Cloud IAM using the least-privilege predefined role `roles/storage.objectCreator`.

Step-by-Step Solution

1
Analyze the error cause
Uniform Bucket-Level Access (UBLA) disables Access Control Lists (ACLs) entirely for the bucket and all objects contained within it.
Attempts to specify per-object ACL flags during commands like `gcloud storage cp` will fail with an explicit API validation error when UBLA is enforced.
2
Identify the remediation for command flags
Remove fine-grained ACL parameters (such as `--predefined-acl` or `--acl`) from the CLI execution command.
Permissions must be handled exclusively through Cloud IAM rather than ACL headers.
3
Configure least-privilege IAM permissions
Assign the predefined `roles/storage.objectCreator` role to the service account on `fintech-settlements-prod`.
Granting `roles/storage.objectCreator` satisfies the least privilege requirement for write-only log ingestion without granting unnecessary read or admin privileges.

Key Concept

Uniform Bucket-Level Access Enforcement and IAM Role Assignment
Rate this question

Topics

Configuring Storage Access Controls and Uniform Bucket-Level Access

More questions from this topic