Examkin

Question

Difficulty: Very hardConfiguring Storage Access Controls and Uniform Bucket-Level Access

An enterprise security engineering team must standardize access control on a production Cloud Storage bucket currently configured with fine-grained Access Control Lists (ACLs). Company security policy requires enforcing access exclusively through Cloud IAM permissions while completely disabling object-level ACL evaluation, adhering to the principle of least privilege. Which TWO configuration actions must the team take to accomplish this requirement without disrupting access for authorized users?

  1. Enable Uniform Bucket-Level Access (UBLA) on the Cloud Storage bucket to disable object ACL evaluation.Answer
  2. B
    Apply custom per-object ACL entries specifying `READER` access prior to enforcing Uniform Bucket-Level Access.
  3. Grant predefined roles such as Storage Object Viewer (`roles/storage.objectViewer`) at the bucket level to users requiring read access.Answer
  4. D
    Grant the primitive Viewer role (`roles/viewer`) at the GCP project level to preserve object accessibility across all buckets.

Answer

The security team must enable Uniform Bucket-Level Access on the Cloud Storage bucket and assign predefined IAM roles, such as Storage Object Viewer, at the bucket level to authorized users.
Enabling Uniform Bucket-Level Access (UBLA) unifies access control under Cloud IAM by disabling fine-grained ACLs on objects. Granting predefined IAM roles like Storage Object Viewer at the bucket level ensures users maintain precise, least-privilege access to objects inside the bucket.

Step-by-Step Solution

1
Identify access requirements
Determine that permissions must be managed centrally using Cloud IAM rather than per-object ACLs.
Fine-grained ACLs add operational complexity and bypass centralized Cloud IAM governance.
2
Enforce uniform access management
Enable Uniform Bucket-Level Access on the bucket.
Enabling UBLA ensures Cloud Storage ignores existing object ACLs and relies solely on bucket-level and project-level IAM policies.
3
Apply least-privilege IAM roles
Assign predefined roles (such as `roles/storage.objectViewer`) directly to principals at the bucket level.
Predefined roles provide scoped, least-privilege access needed for specific workloads without granting broad project-wide rights.

Key Concept

Uniform Bucket-Level Access (UBLA) and IAM Access Control
Rate this question

Topics

Configuring Storage Access Controls and Uniform Bucket-Level Access

More questions from this topic