Your organization plans to enforce uniform security policies across all Google Cloud Storage buckets. You need to transition a bucket currently using fine-grained access control to Uniform Bucket-Level Access without interrupting existing user access. In what sequence should you execute these migration steps?
- 1Audit existing fine-grained object ACLs to catalog all users and service accounts relying on per-object permissions.
- 2Grant equivalent predefined IAM roles (such as Storage Object Viewer) at the bucket level to the identified users and service accounts.
- 3Enable Uniform Bucket-Level Access on the Cloud Storage bucket to disable all fine-grained ACLs.
- 4Audit access logs and test application workflows to confirm successful access enforcement without permission denied errors.
Answer
The correct sequence begins by auditing existing object ACLs, granting equivalent IAM roles at the bucket level, enabling Uniform Bucket-Level Access on the bucket, and finally validating access through log audits and workflow testing.
The correct process mandates auditing existing ACLs first to determine access needs, granting equivalent IAM roles at the bucket level to prevent downtime, enabling Uniform Bucket-Level Access to enforce bucket-wide IAM controls, and verifying post-migration access using audit logs.
Step-by-Step Solution
Key Concept
Migrating fine-grained ACLs to Uniform Bucket-Level Access in Google Cloud Storage