Examkin

Question

Difficulty: MediumConfiguring Storage Access Controls and Uniform Bucket-Level Access

A DevOps team configures a central Cloud Storage bucket named `invoice-processing-2026` to store incoming billing documents. To comply with corporate security standards, Uniform Bucket-Level Access (UBLA) has been enabled on the bucket. Shortly after, an automated data ingestion script fails with a permissions error when attempting to upload a document while specifying a fine-grained object Access Control List (ACL). Which action should the cloud engineer take to enable successful uploads while maintaining compliance with the security policy?

  1. Update the ingestion script to omit object-level ACL requests and ensure the service account is granted an appropriate IAM role, such as Storage Object Creator, on the bucket.Answer
  2. B
    Disable Uniform Bucket-Level Access on the bucket, execute the script to apply object-level ACLs, and then re-enable Uniform Bucket-Level Access.
  3. C
    Grant the primitive Editor role to the ingestion service account at the GCP project level so that it can bypass Uniform Bucket-Level Access enforcement.
  4. D
    Revoke IAM Storage roles at the bucket level so that individual object ACL grants specified in the script take precedence.

Answer

Update the ingestion script to omit object-level ACL requests and ensure the service account is granted an appropriate IAM role, such as Storage Object Creator, on the bucket.
Enabling Uniform Bucket-Level Access (UBLA) unifies access control under Cloud IAM and disables legacy per-object ACLs. To resolve upload failures caused by an application specifying object ACLs, the application code must be updated to upload objects without ACL parameters, and the service account must be granted an appropriate predefined IAM role (such as Storage Object Creator).

Step-by-Step Solution

1
Analyze the error context
Identify that Uniform Bucket-Level Access (UBLA) explicitly disables Access Control Lists (ACLs) across all objects in the bucket.
When UBLA is active, any attempt to set or modify fine-grained ACLs on objects causes an API error.
2
Remediate application client behavior
Remove flags or parameters requesting canned or specific ACLs from the upload request in the ingestion script.
Client applications must use standard object uploads without specifying object-level ACLs when target buckets enforce UBLA.
3
Verify and grant IAM access
Assign the predefined IAM role Storage Object Creator (roles/storage.objectCreator) or Storage Object Admin to the uploading service account.
IAM is the unified access control mechanism for buckets with Uniform Bucket-Level Access enabled.

Key Concept

Uniform Bucket-Level Access (UBLA) disables fine-grained Object ACLs in favor of centralized Cloud IAM policies.
Rate this question

Topics

Configuring Storage Access Controls and Uniform Bucket-Level Access

More questions from this topic