Examkin

Question

Difficulty: MediumConfiguring Storage Access Controls and Uniform Bucket-Level Access

A cloud engineer needs to grant a service account read access to files stored in a Cloud Storage bucket named `customer-analytics-data`. Uniform Bucket-Level Access is currently enabled on the bucket. When an automated script attempts to apply fine-grained object Access Control Lists (ACLs) to grant read permission, the operation fails. Which action should the engineer take to properly grant the service account read access while adhering to Google Cloud security best practices?

  1. Grant the predefined Cloud Storage IAM role `roles/storage.objectViewer` to the service account at the bucket level.Answer
  2. B
    Use `gcloud storage objects update` with a canned ACL of `projectPrivate` to override the Uniform Bucket-Level Access restriction on individual objects.
  3. C
    Grant the primitive `roles/viewer` role to the service account at the GCP project level so it inherits read permissions for all bucket objects.
  4. D
    Disable IAM policy inheritance on the bucket so object ACLs can override project-level access controls.

Answer

Grant the predefined Cloud Storage IAM role `roles/storage.objectViewer` to the service account at the bucket level.
When Uniform Bucket-Level Access is enabled on a Cloud Storage bucket, access control lists (ACLs) are disabled, and Cloud IAM becomes the sole access control mechanism. The standard Google Cloud security recommendation is to grant predefined IAM roles (such as Storage Object Viewer) at the bucket level to provide necessary access following the principle of least privilege.

Step-by-Step Solution

1
Identify the cause of the failure
Uniform Bucket-Level Access (UBLA) explicitly disables ACL evaluation and rejects per-object ACL operations.
UBLA simplifies security by ensuring all permissions are managed strictly through Cloud IAM.
2
Select the appropriate IAM permission model
Use Cloud IAM bucket-level role binding instead of object ACLs.
IAM roles apply uniformly to all objects in the bucket when UBLA is enabled.
3
Apply the principle of least privilege
Assign `roles/storage.objectViewer` to the specific service account at the bucket level rather than granting primitive roles at the project level.
Predefined roles restrict access specifically to Cloud Storage objects without exposing other project resources.

Key Concept

Uniform Bucket-Level Access & Cloud IAM Best Practices
Rate this question

Topics

Configuring Storage Access Controls and Uniform Bucket-Level Access

More questions from this topic