Examkin

Soru

Zorluk: ZorConfiguring Storage Access Controls and Uniform Bucket-Level Access

An e-commerce platform recently enabled Uniform Bucket-Level Access on a Cloud Storage bucket named `order-receipts-prod` to align with company security governance. Shortly after enforcement, an automated ingestion microservice fails when uploading receipt PDFs, returning an HTTP 400 error indicating that Access Control Lists (ACLs) are disabled. Inspection reveals the microservice uses a legacy SDK configured to attach a `public-read` canned ACL to each uploaded object. You must restore microservice functionality while maintaining Uniform Bucket-Level Access compliance on the bucket. Which action should you take?

  1. Update the microservice code to upload objects without specifying canned ACLs, and assign the Storage Object Creator role to the microservice service account on the bucket.Cevap
  2. B
    Modify the bucket configuration to allow fine-grained ACLs alongside Uniform Bucket-Level Access so the legacy canned ACL uploads can succeed.
  3. C
    Remove the canned ACL payload from the microservice and grant the microservice service account the Project Editor primitive role.
  4. D
    Grant object-level Owner ACLs to the microservice service account and revoke IAM Viewer permissions at the project level to override inherited access.

Cevap

Update the microservice code to upload objects without specifying canned ACLs, and assign the Storage Object Creator role to the microservice service account on the bucket.
When Uniform Bucket-Level Access (UBLA) is enabled on a Google Cloud Storage bucket, fine-grained object Access Control Lists (ACLs) are disabled. All access must be authorized using Cloud IAM permissions. Removing the legacy canned ACL metadata from the application's upload request fixes the API rejection, while granting the predefined 'Storage Object Creator' IAM role to the microservice's service account ensures least-privilege compliance.

Adım Adım Çözüm

1
Identify the cause of the HTTP 400 upload failure.
Uniform Bucket-Level Access (UBLA) disables all legacy Access Control Lists (ACLs), causing object creation calls containing canned ACL parameters (such as public-read) to fail.
UBLA unifies access management strictly under Cloud IAM policies at the bucket and project level.
2
Remediate the client application request payload.
The microservice must stop sending canned ACL metadata during upload operations.
Removing ACL parameters ensures compatibility with UBLA-enforced buckets.
3
Grant minimum necessary IAM permissions to the application identity.
Assign the predefined IAM role Storage Object Creator (roles/storage.objectCreator) to the microservice's service account at the bucket level.
This grants the exact permission (storage.objects.create) needed to write objects without granting excessive project-wide permissions.

Anahtar Kavram

Uniform Bucket-Level Access and IAM Role Allocation
Bu soruyu puanla

Konular

Configuring Storage Access Controls and Uniform Bucket-Level Access

Bu konudan daha fazla soru