Examkin

Question

Difficulty: MediumConfiguring Storage Access Controls and Uniform Bucket-Level Access

A security analyst is hardening a Cloud Storage bucket named `compliance-audit-logs` that currently permits fine-grained Access Control Lists (ACLs). The analyst needs to restrict access control exclusively to IAM policies across all current and future objects, while granting an internal compliance team view access to the stored logs. Which TWO actions should the security analyst perform to achieve this requirement? (Select TWO.)

  1. Enable Uniform Bucket-Level Access on the `compliance-audit-logs` bucket.Answer
  2. B
    Apply a per-object ACL with READER permissions for the compliance team on each object inside the bucket.
  3. Grant the `roles/storage.objectViewer` IAM role to the compliance team identity on the `compliance-audit-logs` bucket.Answer
  4. D
    Grant the primitive `roles/Viewer` role to the compliance team at the Google Cloud Project level.

Answer

The security analyst should enable Uniform Bucket-Level Access on the bucket and grant the predefined `roles/storage.objectViewer` IAM role to the compliance team at the bucket level.
To ensure access control is managed exclusively through IAM, Uniform Bucket-Level Access must be enabled on the target Cloud Storage bucket. To grant the required read access to log objects adhering to the principle of least privilege, the predefined role `roles/storage.objectViewer` should be assigned to the compliance team at the bucket level.

Step-by-Step Solution

1
Enforce unified access management by disabling legacy fine-grained ACLs.
Uniform Bucket-Level Access is enabled, ensuring that individual object ACLs are ignored and only IAM policies govern access.
Uniform Bucket-Level Access unifies access management under Cloud IAM, eliminating ACL bypass security risks.
2
Assign the least-privilege predefined IAM role for read operations.
The compliance team receives read access to all objects within the specific bucket without gaining unintended access across the project.
The predefined role `roles/storage.objectViewer` provides the necessary object-read permissions scoped to the target bucket.

Key Concept

Uniform Bucket-Level Access and Predefined Storage IAM Roles
Rate this question

Topics

Configuring Storage Access Controls and Uniform Bucket-Level Access

More questions from this topic