Examkin

Question

Difficulty: Very hardConfiguring Storage Access Controls and Uniform Bucket-Level Access

A DevOps engineer manages a Cloud Storage bucket named `analytics-central-logs-prod` that has Uniform Bucket-Level Access (UBLA) enforced across the enterprise. A third-party security auditing application running on a Compute Engine instance uses a dedicated service account. The application requires read access strictly to log files located under the `application-a/` object prefix path (`gs://analytics-central-logs-prod/application-a/*`), but must be denied access to all other object prefixes inside the bucket. A team member proposes running a command to set fine-grained Access Control Lists (ACLs) on the object prefix, but the command fails with a 400 Bad Request error due to UBLA. Which configuration approach correctly grants the required scoped access while maintaining compliance with UBLA?

  1. Grant the Storage Object Viewer (`roles/storage.objectViewer`) role to the service account at the bucket level, conditioned with an IAM Condition that checks `resource.name.startsWith("projects/_/buckets/analytics-central-logs-prod/objects/application-a/")`.Answer
  2. B
    Temporarily disable Uniform Bucket-Level Access on `analytics-central-logs-prod`, run `gcloud storage objects add-acl` to grant Reader permissions to the service account on the `application-a/` prefix, and re-enable Uniform Bucket-Level Access.
  3. C
    Grant the primitive Viewer (`roles/viewer`) role to the service account at the GCP project level, and rely on Cloud IAM implicit prefix filtering to isolate `application-a/` bucket objects.
  4. D
    Grant the Storage Object Viewer (`roles/storage.objectViewer`) role to the service account at the bucket level, and apply an explicit IAM Deny policy on the bucket for all resource names that do not match the `application-a/` prefix.

Answer

Grant the predefined Storage Object Viewer (`roles/storage.objectViewer`) role to the service account at the bucket level, combined with an IAM Condition that filters `resource.name` using `startsWith("projects/_/buckets/analytics-central-logs-prod/objects/application-a/")`.
When Uniform Bucket-Level Access (UBLA) is enabled on a Cloud Storage bucket, individual object ACLs cannot be used. To grant granular access to a specific object prefix without disabling UBLA, Cloud IAM Conditions should be attached to a bucket-level role binding (such as Storage Object Viewer). The condition checks the `resource.name` attribute using `startsWith()` matching on the target bucket and prefix path.

Step-by-Step Solution

1
Identify access control constraints under Uniform Bucket-Level Access (UBLA).
Recognize that fine-grained per-object ACLs (`gsutil acl` or `gcloud storage objects add-acl`) are disabled when UBLA is enforced on a bucket.
UBLA disables ACLs completely to standardize IAM permissions across all objects in the bucket.
2
Determine how to achieve object-prefix scoping within UBLA.
Use Cloud IAM Conditions on bucket-level role bindings.
IAM Conditions support evaluating object resource attributes such as `resource.name` using prefix matching functions like `startsWith()`.
3
Select the appropriate IAM role adhering to the principle of least privilege.
Use `roles/storage.objectViewer` conditioned on `resource.name.startsWith("projects/_/buckets/analytics-central-logs-prod/objects/application-a/")`.
This grants read-only object access exclusively to objects residing within the specified prefix while satisfying UBLA policy compliance.

Key Concept

Uniform Bucket-Level Access and IAM Conditions for Object Prefix Scoping
Estimated Time:2m 0s
Rate this question

Topics

Configuring Storage Access Controls and Uniform Bucket-Level Access

More questions from this topic