A cloud administrator is configuring access controls for a Google Cloud Storage bucket and needs to enforce Uniform Bucket-Level Access (UBLA) to meet security compliance standards. Which TWO statements accurately describe the behavior and enforcement when Uniform Bucket-Level Access is enabled on a Cloud Storage bucket?
- Access to all objects in the bucket is controlled exclusively through IAM permissions, disabling Object ACLs.Answer
- BUsers can continue to set fine-grained ACL permissions on individual objects within the bucket.
- Existing individual object ACL settings are ignored and ACL access requests are revoked in favor of IAM policy evaluations.Answer
- DPrimitive roles such as Owner or Editor must be granted on individual objects to override bucket-level restrictions.
Answer
Access to all objects in the bucket is controlled exclusively through IAM permissions, disabling Object ACLs, and existing individual object ACL settings are ignored in favor of IAM policy evaluations.
Uniform Bucket-Level Access (UBLA) ensures that Cloud Storage evaluates access permissions using Cloud IAM exclusively. When UBLA is enabled, per-object ACL access lists are disabled and ignored, standardizing security management across all objects in the bucket.
Step-by-Step Solution
Key Concept
Uniform Bucket-Level Access (UBLA) enforcement and IAM access control