A cloud engineer is managing a Google Cloud Storage bucket that contains confidential audit records. To enforce organization-wide security policies, Uniform Bucket-Level Access was recently enabled on the bucket. However, external auditors report that they can no longer view specific objects that were previously accessible via fine-grained object Access Control Lists (ACLs). You need to restore the auditors' read access while maintaining compliance with the uniform access mandate. What should you do?
- Grant the Storage Object Viewer IAM role to the auditors at the bucket level.Answer
- BRun a command to apply object-level READ ACLs directly to the individual audit record objects.
- CAssign the primitive Owner role to the auditors on the host Google Cloud project.
- DDisable Uniform Bucket-Level Access on the project level and attach IAM deny policies to restricted objects.
Answer
Grant the Storage Object Viewer IAM role to the auditors at the bucket level.
Enabling Uniform Bucket-Level Access (UBLA) turns off ACLs for all objects in the bucket, making Cloud IAM the sole mechanism for access control. To restore read access for the external auditors while respecting the principle of least privilege and UBLA enforcement, you must grant the predefined Storage Object Viewer IAM role to the auditors at the bucket level.
Step-by-Step Solution
Key Concept
Uniform Bucket-Level Access disables fine-grained per-object ACLs, requiring Cloud Storage access permissions to be managed exclusively via Cloud IAM roles applied at the bucket or project level.