A software team deployed an application to Compute Engine that processes images uploaded to a Cloud Storage bucket named `media-processing-prod`. The security team recently enabled Uniform Bucket-Level Access on the bucket to meet organizational compliance requirements. Following this change, the application throws an error whenever it attempts to grant fine-grained permissions using object Access Control Lists (ACLs). According to Google Cloud security best practices, which action should the cloud administrator take to resolve the application errors and properly manage access?
- ADisable Uniform Bucket-Level Access on the bucket and grant per-object ACL access to the application service account.
- Update the application logic to rely on IAM permissions and assign the predefined role Storage Object Viewer or Storage Object Admin to the service account at the bucket level.Answer
- CGrant the primitive Viewer role (roles/viewer) to the application service account at the Google Cloud project level to enable object-level ACL modifications.
- DRemove bucket-level IAM roles and configure custom IAM denial rules at the individual object path level.
Answer
Update the application logic to rely on IAM permissions and assign the predefined role Storage Object Viewer or Storage Object Admin to the service account at the bucket level.
Enabling Uniform Bucket-Level Access (UBLA) centralizes access control under Google Cloud IAM and turns off fine-grained Access Control Lists (ACLs) for all objects in the bucket. To grant access properly, applications must rely on bucket-level or project-level IAM bindings using predefined Cloud Storage roles (e.g., Storage Object Viewer or Storage Object User).
Step-by-Step Solution
Key Concept
Configuring Storage Access Controls and Uniform Bucket-Level Access