Examkin

Question

Difficulty: Very hardConfiguring Storage Access Controls and Uniform Bucket-Level Access

A cloud engineer is migrating an enterprise Cloud Storage bucket named `archival-reports-prod` to meet security audit compliance standards requiring Uniform Bucket-Level Access (UBLA). Previously, legacy applications relied on individual object Access Control Lists (ACLs) for read permissions. Immediately after the engineer enables UBLA on the bucket, a dedicated service account `[email protected]` receives HTTP 403 Access Denied errors when reading objects. The engineer must restore object read permissions for this service account while strictly maintaining UBLA enforcement. Which administrative action should the engineer take?

  1. Grant the predefined Storage Object Viewer role (roles/storage.objectViewer) to serviceAccount:[email protected] at the bucket level.Answer
  2. B
    Execute gcloud storage objects update gs://archival-reports-prod/* --add-acl-grant=entity=serviceAccount:[email protected],role=READER to re-grant read access on all objects.
  3. C
    Grant the primitive Viewer role (roles/viewer) to serviceAccount:[email protected] at the Google Cloud project level.
  4. D
    Disable Uniform Bucket-Level Access, grant object ACLs to the service account, and attach a project-level IAM deny policy to block access to all other buckets.

Answer

Grant the predefined Storage Object Viewer role (roles/storage.objectViewer) to serviceAccount:[email protected] at the bucket level.
When Uniform Bucket-Level Access (UBLA) is enabled on a Cloud Storage bucket, ACLs are disabled and ignored. Permission management transitions exclusively to IAM. Assigning the predefined Storage Object Viewer role (`roles/storage.objectViewer`) directly to the service account at the bucket level grants read access to all objects in the bucket while upholding UBLA compliance and maintaining least-privilege security standards.

Step-by-Step Solution

1
Analyze the impact of enabling Uniform Bucket-Level Access (UBLA) on Google Cloud Storage buckets.
Enabling UBLA disables all per-object ACLs, meaning object access relies entirely on Cloud Storage IAM permissions granted at the bucket, folder, or project level.
Legacy applications using object ACLs lose access when UBLA is enabled because ACL checks are bypassed and ignored.
2
Identify the appropriate IAM role and scope to restore access under the principle of least privilege.
The predefined role `roles/storage.objectViewer` granted on the specific bucket provides read access to all objects in that bucket without exposing other resources or project services.
IAM roles at the bucket level satisfy the UBLA requirement while giving the exact permissions needed by the service account.
3
Evaluate alternative option proposals against GCP security best practices.
Modifying object ACLs fails under UBLA, granting primitive project roles violates least privilege, and disabling UBLA fails the mandatory security audit criteria.
Only bucket-level predefined IAM role assignment satisfies both access requirements and security constraints.

Key Concept

Uniform Bucket-Level Access (UBLA) enforcement and Cloud Storage IAM role delegation
Rate this question

Topics

Configuring Storage Access Controls and Uniform Bucket-Level Access

More questions from this topic