An organization is standardizing security compliance across its Google Cloud environment. A cloud engineer enables Uniform Bucket-Level Access (UBLA) on an existing Cloud Storage bucket that previously relied on fine-grained Access Control Lists (ACLs) attached to individual objects. Immediately after enabling UBLA, an automated reporting application's service account loses read access to specific legacy files in the bucket. The engineer needs to restore read access to all objects in the bucket for this service account while adhering to the principle of least privilege and maintaining uniform bucket access controls. Which action should the engineer take?
- Grant the predefined Storage Object Viewer role (roles/storage.objectViewer) to the application's service account on the Cloud Storage bucket.Cevap
- BUse the gcloud storage objects update command with the ACL flag to re-grant READER access to the service account on the affected objects.
- CGrant the primitive Viewer role (roles/viewer) to the application's service account at the bucket level.
- DConfigure an explicit IAM Deny policy on the bucket to revoke project-level Editor permissions before re-enabling fine-grained object access.
Cevap
Grant the predefined Storage Object Viewer role (roles/storage.objectViewer) to the application's service account at the bucket level.
When Uniform Bucket-Level Access (UBLA) is enabled on a Cloud Storage bucket, Object-Level Access Control Lists (ACLs) are completely disabled. Access control is managed exclusively through Cloud IAM permissions. To restore read access for a service account without granting excessive permissions, the predefined `roles/storage.objectViewer` role should be assigned to the principal at the bucket level.
Adım Adım Çözüm
Anahtar Kavram
Uniform Bucket-Level Access (UBLA) disables per-object ACLs and relies strictly on Cloud IAM policies granted at the bucket, folder, or project level.