A Cloud Engineer is tasked with migrating an enterprise Cloud Storage bucket containing legacy internal archives from fine-grained Access Control Lists (ACLs) to Uniform Bucket-Level Access (UBLA) to comply with organization security policies. Place the administrative steps in the correct sequential order to perform this migration safely without disrupting user access.
- 1Audit existing object-level ACL permissions on the Cloud Storage bucket to identify all principals relying on fine-grained access.
- 2Grant equivalent predefined Cloud IAM roles (e.g., Storage Object Viewer) at the bucket or project level to the identified principals.
- 3Enable Uniform Bucket-Level Access on the bucket using gcloud storage buckets update to enforce uniform IAM permissions and disable ACLs.
- 4Verify object access using IAM credentials and inspect Cloud Audit Logs to confirm that no access denied errors occur.
Answer
The correct sequence begins with auditing existing object ACL permissions, followed by assigning equivalent predefined IAM roles to affected principals, then enabling Uniform Bucket-Level Access on the bucket, and concluding with verifying object access and log monitoring.
The correct order follows GCP security best practices for migrating from ACLs to Uniform Bucket-Level Access: 1) Identify existing access requirements via an audit, 2) Provision equivalent IAM roles to prevent service disruption, 3) Turn on Uniform Bucket-Level Access on the bucket, and 4) Verify operation and monitor logs.
Step-by-Step Solution
Key Concept
Uniform Bucket-Level Access (UBLA) migration workflow requires auditing legacy ACL access and granting IAM roles before disabling ACL processing on Cloud Storage buckets.