Examkin

Soru

Zorluk: ZorConfiguring Storage Access Controls and Uniform Bucket-Level Access

A cloud engineer is standardizing security controls across Google Cloud Storage buckets. The team recently enabled Uniform Bucket-Level Access on a bucket named `app-audit-logs` to comply with organization security policies. An automated deployment script now fails when executing `gcloud storage objects add-acl --object=daily_summary.json --rw-grant=...` to grant read access to a downstream processing account. What is the recommended operational fix to grant access while adhering to the security policy?

  1. Grant the downstream processing account the Storage Object Viewer role on the bucket, using IAM Conditions to restrict permission to the target object path.Cevap
  2. B
    Temporarily disable Uniform Bucket-Level Access on the bucket, execute the object ACL command to grant access, and re-enable Uniform Bucket-Level Access.
  3. C
    Grant the downstream processing account the primitive Viewer role at the Google Cloud project level.
  4. D
    Execute gcloud storage buckets add-acl to apply a bucket-level ACL entry for the downstream account.

Cevap

Grant the downstream processing account the Storage Object Viewer role on the bucket, using IAM Conditions to restrict permission to the target object path.
When Uniform Bucket-Level Access (UBLA) is enabled, Cloud Storage disables ACLs and manages permissions strictly through Cloud IAM. To grant access to specific objects without violating UBLA or granting excessive permissions, administrators should assign predefined Cloud Storage IAM roles (such as Storage Object Viewer) at the bucket level and apply IAM Conditions to scope access to the required object path.

Adım Adım Çözüm

1
Identify the cause of the command failure.
Uniform Bucket-Level Access (UBLA) disables legacy Access Control Lists (ACLs) entirely for the bucket and its objects.
All object-level ACL operations (such as gcloud storage objects add-acl) fail when UBLA is enforced.
2
Determine the appropriate access management mechanism under UBLA.
Access must be granted exclusively via Cloud IAM policies.
UBLA unifies access control strictly through Google Cloud IAM.
3
Configure scoped IAM access using predefined roles and conditions.
Assign the Storage Object Viewer role at the bucket level scoped with an IAM Condition matching the target object path.
This grants access to the specific object while maintaining UBLA compliance and adhering to the principle of least privilege.

Anahtar Kavram

Uniform Bucket-Level Access & IAM Scoping
Bu soruyu puanla

Konular

Configuring Storage Access Controls and Uniform Bucket-Level Access

Bu konudan daha fazla soru