A cloud security engineer needs to transition a legacy Cloud Storage bucket containing audit logs from fine-grained Access Control Lists (ACLs) to Uniform Bucket-Level Access (UBLA) without disrupting active applications or causing permission denials. In what correct chronological sequence should the engineer execute the following operational steps to safely enforce bucket-level access control?
- 1Audit existing object-level and bucket-level ACLs to identify all unique user and service account access requirements.
- 2Map the discovered ACL permissions to equivalent Google Cloud Storage predefined IAM roles (such as Storage Object Viewer or Storage Object Creator).
- 3Apply the mapped IAM role bindings to the target bucket for all relevant service accounts and user groups.
- 4Enable Uniform Bucket-Level Access (UBLA) on the Cloud Storage bucket to disallow ACL checks and enforce IAM policies uniformly.
Answer
The correct operational order is: 1) Audit existing object-level and bucket-level ACLs to identify all access requirements, 2) Map discovered ACL permissions to equivalent Cloud Storage predefined IAM roles, 3) Apply the mapped IAM role bindings to the target bucket, and 4) Enable Uniform Bucket-Level Access (UBLA) on the Cloud Storage bucket.
The migration process requires discovering existing access rules, translating them into IAM role assignments, granting those IAM roles at the bucket level, and finally toggling Uniform Bucket-Level Access. This guarantees zero service interruption while enforcing uniform security governance.
Step-by-Step Solution
Key Concept
Migrating from Fine-Grained ACLs to Uniform Bucket-Level Access (UBLA)