Your organization recently enforced Uniform Bucket-Level Access (UBLA) on a Google Cloud Storage bucket named `partner-data-exchange` to align with security compliance requirements. Shortly after this enforcement, an automated data ingestion pipeline fails when attempting to upload new files. Investigation shows that the ingestion script explicitly passes per-object Access Control List (ACL) parameters (`publicRead`) during object creation calls. Which action should you take to restore pipeline functionality while maintaining compliance with the security policy?
- Update the ingestion script to remove the per-object ACL parameters and grant the pipeline service account the Storage Object Creator IAM role on the bucket.Answer
- BDisable Uniform Bucket-Level Access on the bucket so the ingestion script can continue setting individual object ACLs.
- CAssign the primitive Owner role to the pipeline service account at the project level to bypass the bucket's access restrictions.
- DConfigure an object-level IAM Deny policy to override the bucket-level Uniform Bucket-Level Access setting for the ingestion script.
Answer
Update the ingestion script to remove the per-object ACL parameters and grant the pipeline service account the Storage Object Creator IAM role on the bucket.
When Uniform Bucket-Level Access is enabled on a bucket, Cloud Storage disables ACL permissions and enforces access through Cloud IAM exclusively. Any requests specifying per-object ACLs fail with an access error. To resolve this without compromising compliance, the client code must stop requesting per-object ACLs and rely on bucket-level IAM roles such as Storage Object Creator.
Step-by-Step Solution
Key Concept
Uniform Bucket-Level Access disables object ACLs, requiring access permissions to be defined entirely using IAM roles.
Estimated Time:1m 30s