A security auditor requires your team to standardize security controls on an active production Cloud Storage bucket currently configured with fine-grained access control. You must transition this bucket to enforce Uniform Bucket-Level Access (UBLA) without causing access disruptions for authorized applications and service accounts. Arrange the operational steps in the correct chronological sequence to safely complete this security migration.
- 1Audit existing object-level and bucket-level Access Control Lists (ACLs) to catalog all individual user and service account permissions.
- 2Grant equivalent predefined Cloud IAM storage roles (such as Storage Object Viewer or Storage Object Admin) at the bucket level to the identified principals.
- 3Enable Uniform Bucket-Level Access on the bucket by running `gcloud storage buckets update gs://[BUCKET_NAME] --uniform-bucket-level-access`.
- 4Monitor Cloud Audit Logs and application traffic during the 90-day grace period to verify that all authorization requests succeed under IAM policy evaluation.
- 5Lock Uniform Bucket-Level Access on the bucket to permanently prevent disabling UBLA or reapplying fine-grained ACL controls.
Answer
The correct operational order for migrating to Uniform Bucket-Level Access is: 1) Audit existing object and bucket ACLs, 2) Grant equivalent IAM roles at the bucket level, 3) Enable Uniform Bucket-Level Access using the CLI, 4) Monitor access logs during the grace period, and 5) Lock Uniform Bucket-Level Access permanently.
Safely transitioning a bucket from fine-grained ACLs to Uniform Bucket-Level Access requires a structured approach: auditing existing ACL access, mapping those permissions to appropriate Cloud IAM predefined roles at the bucket level, activating UBLA via gcloud, validating application behavior during the 90-day grace period, and finally locking the UBLA policy to enforce compliance permanently.
Step-by-Step Solution
Key Concept
Migrating to Uniform Bucket-Level Access (UBLA)