Examkin

Question

Difficulty: MediumConfiguring Storage Access Controls and Uniform Bucket-Level Access

A DevOps engineer is updating an automated data pipeline script that uploads nightly log archives to a Cloud Storage bucket named `analytics-logs-prod`. The security team recently enabled Uniform Bucket-Level Access (UBLA) on this bucket to satisfy compliance requirements. Following this change, the pipeline script fails during file upload when executing `gcloud storage cp` with the `--canned-acl=bucket-owner-full-control` flag. How should the engineer resolve this pipeline failure while following Google Cloud security best practices?

  1. Remove the canned ACL flag from the upload command and assign the Storage Object Creator predefined IAM role to the pipeline service account.Answer
  2. B
    Disable Uniform Bucket-Level Access on the Cloud Storage bucket so that the script can continue specifying object-level ACL flags during upload.
  3. C
    Grant the primitive Owner role to the pipeline service account at the project level to bypass Uniform Bucket-Level Access restriction checks.
  4. D
    Add a project-level IAM deny policy that revokes ACL evaluation for object uploads while retaining the canned ACL flag in the command.

Answer

Remove the canned ACL flag from the upload command and assign the Storage Object Creator predefined IAM role to the pipeline service account.
When Uniform Bucket-Level Access is enabled on a Cloud Storage bucket, individual object ACLs are ignored and specifying canned ACL parameters in CLI or SDK calls causes an API error. The recommended remediation is removing the ACL parameter from the upload command and delegating access control strictly to predefined Cloud Storage IAM roles like Storage Object Creator.

Step-by-Step Solution

1
Identify the cause of the operation failure.
Uniform Bucket-Level Access (UBLA) disables Access Control Lists (ACLs) entirely for all objects in the bucket.
When UBLA is enabled, specifying canned ACL flags (such as `--canned-acl` or `gsutil -a`) causes requests to be rejected by Cloud Storage.
2
Modify the pipeline upload command.
Remove the `--canned-acl` flag from the `gcloud storage cp` invocation.
Object permissions are now governed uniformly at the bucket level using IAM.
3
Verify and grant appropriate IAM roles.
Assign `roles/storage.objectCreator` to the service account executing the upload.
Following the principle of least privilege, `roles/storage.objectCreator` provides exact permissions required to write objects without exposing excess project-wide permissions.

Key Concept

Uniform Bucket-Level Access (UBLA) disables individual object ACLs and mandates Google Cloud IAM for all access control decisions on the bucket.
Rate this question

Topics

Configuring Storage Access Controls and Uniform Bucket-Level Access

More questions from this topic