Question

Difficulty: MediumConfiguring Storage Access Controls and Uniform Bucket-Level Access

A Cloud Engineer is tasked with migrating an enterprise Cloud Storage bucket containing legacy internal archives from fine-grained Access Control Lists (ACLs) to Uniform Bucket-Level Access (UBLA) to comply with organization security policies. Place the administrative steps in the correct sequential order to perform this migration safely without disrupting user access.

  1. 1Audit existing object-level ACL permissions on the Cloud Storage bucket to identify all principals relying on fine-grained access.
  2. 2Grant equivalent predefined Cloud IAM roles (e.g., Storage Object Viewer) at the bucket or project level to the identified principals.
  3. 3Enable Uniform Bucket-Level Access on the bucket using gcloud storage buckets update to enforce uniform IAM permissions and disable ACLs.
  4. 4Verify object access using IAM credentials and inspect Cloud Audit Logs to confirm that no access denied errors occur.

Answer

The correct sequence begins with auditing existing object ACL permissions, followed by assigning equivalent predefined IAM roles to affected principals, then enabling Uniform Bucket-Level Access on the bucket, and concluding with verifying object access and log monitoring.
The correct order follows GCP security best practices for migrating from ACLs to Uniform Bucket-Level Access: 1) Identify existing access requirements via an audit, 2) Provision equivalent IAM roles to prevent service disruption, 3) Turn on Uniform Bucket-Level Access on the bucket, and 4) Verify operation and monitor logs.

Step-by-Step Solution

1
Audit current access permissions
Identify all users, groups, and service accounts using per-object ACL access
Before revoking ACL evaluations, you must identify every principal relying on fine-grained object access to prevent unexpected outages.
2
Assign corresponding predefined IAM roles
Principals receive bucket-level or project-level IAM permissions (such as roles/storage.objectViewer)
Uniform Bucket-Level Access relies entirely on IAM policies; granting permissions via IAM prior to enabling UBLA maintains uninterrupted access.
3
Enable Uniform Bucket-Level Access
ACLs are disabled on the bucket and all contained objects
Executing the configuration update enforces uniform security across the entire bucket.
4
Validate and monitor access
Confirmed operational status via access tests and Cloud Audit Logs
Verification confirms that no applications or users experience authorization failures under the new IAM security model.

Key Concept

Uniform Bucket-Level Access (UBLA) migration workflow requires auditing legacy ACL access and granting IAM roles before disabling ACL processing on Cloud Storage buckets.
Rate this question