Examkin

Question

Difficulty: MediumConfiguring Storage Access Controls and Uniform Bucket-Level Access

A cloud administrator is configuring access for a Google Cloud Storage bucket named `corp-financial-records`. The security policy requires enforcing central governance by activating Uniform Bucket-Level Access (UBLA). A data analyst requires read-only access to the data in this bucket. How should the administrator grant the analyst the required access while adhering to Google Cloud security best practices?

  1. Grant the predefined `roles/storage.objectViewer` IAM role to the analyst at the bucket level.Answer
  2. B
    Apply a fine-grained Access Control List (ACL) directly to individual objects to give the analyst reader access.
  3. C
    Assign the primitive `roles/viewer` role to the analyst across the entire parent Google Cloud project.
  4. D
    Disable IAM policy inheritance on the bucket so that object-level permissions can take precedence over inherited project roles.

Answer

Grant the predefined `roles/storage.objectViewer` IAM role to the analyst at the bucket level.
When Uniform Bucket-Level Access is enabled on a Cloud Storage bucket, Access Control Lists (ACLs) are disabled, and access management relies entirely on Cloud IAM. Granting the predefined `roles/storage.objectViewer` role to the analyst at the bucket level follows Google Cloud security best practices and the principle of least privilege.

Step-by-Step Solution

1
Analyze the access control requirement and constraint.
Uniform Bucket-Level Access (UBLA) is enabled on `corp-financial-records`, which disables per-object ACLs entirely.
UBLA requires all access to be granted exclusively via Cloud IAM policies.
2
Determine the appropriate identity role for a read-only analyst.
The predefined role `roles/storage.objectViewer` provides permission to view objects without administrative access.
Predefined roles conform to the principle of least privilege.
3
Apply the role at the appropriate resource level.
Assigning the role directly on the Cloud Storage bucket resource scopes permissions specifically to `corp-financial-records`.
Scoped IAM assignments prevent over-granting permissions across unrelated project resources.

Key Concept

Uniform Bucket-Level Access (UBLA) disables Cloud Storage ACLs and mandates access control management via Cloud IAM roles.
Rate this question

Topics

Configuring Storage Access Controls and Uniform Bucket-Level Access

More questions from this topic