A security engineer is tasked with migrating a legacy production Cloud Storage bucket containing financial records from fine-grained Access Control Lists (ACLs) to Uniform Bucket-Level Access (UBLA) in accordance with company security posture mandates. Arrange the migration and enforcement steps in the correct sequential order to prevent service disruption while ensuring strict security policy enforcement.
- 1Analyze Cloud Audit Logs to identify principals accessing objects via legacy ACLs and assign them equivalent Cloud IAM predefined Storage roles at the bucket level.
- 2Execute the command `gcloud storage buckets update gs://[BUCKET_NAME] --uniform-bucket-level-access` to activate bucket-level access control.
- 3Monitor Cloud Monitoring metrics and Cloud Audit Logs for access denials to confirm all client applications are successfully operating under IAM authorization.
- 4Apply the `constraints/storage.uniformBucketLevelAccess` organization policy to the project hierarchy to enforce bucket-level access across all storage resources.
Answer
The correct procedural order is: 1) Analyze Cloud Audit Logs and grant equivalent Cloud IAM predefined roles; 2) Enable Uniform Bucket-Level Access on the Cloud Storage bucket; 3) Monitor metrics and audit logs for access denials during the grace period; 4) Apply the organization policy constraint for uniform bucket-level access.
Migrating to Uniform Bucket-Level Access requires a controlled sequence: first auditing and replacing object ACLs with equivalent IAM roles to preserve access; second enabling UBLA on the bucket to enforce IAM-only access; third monitoring audit logs and metrics during the 90-day window to catch unmapped edge cases; and finally locking security posture at the project/organization level using Organization Policy constraints.
Step-by-Step Solution
Key Concept
Uniform Bucket-Level Access Migration Workflow