Examkin

Soru

Zorluk: ZorConfiguring Storage Access Controls and Uniform Bucket-Level Access

A financial data processing pipeline uploads automated daily extract files into a Cloud Storage bucket named `fin-monthly-extracts`. A legacy batch script executed by a dedicated service account currently sets fine-grained object Access Control Lists (ACLs) using `gsutil acl` after each upload. Security policy now mandates enforcing Uniform Bucket-Level Access across all storage buckets in the project. Which action should you take to enforce compliance while ensuring the batch script can successfully read and write objects?

  1. Grant the service account the predefined Storage Object Admin role at the bucket level, remove the object ACL commands from the script, and enable Uniform Bucket-Level Access on the bucket.Cevap
  2. B
    Enable Uniform Bucket-Level Access on the bucket, and update the batch script to execute `gsutil acl ch` to grant object-level read permissions after each file upload.
  3. C
    Grant the service account the primitive Editor role at the project level, and keep Uniform Bucket-Level Access disabled to preserve legacy object ACL management.
  4. D
    Revoke project-level IAM permissions from the service account and configure ACLs on the destination folder, expecting folder-level ACLs to override IAM policies once Uniform Bucket-Level Access is active.

Cevap

Grant the service account the predefined Storage Object Admin role at the bucket level, remove the object ACL commands from the script, and enable Uniform Bucket-Level Access on the bucket.
Enabling Uniform Bucket-Level Access (UBLA) standardizes Cloud Storage security by delegating all access decisions strictly to Cloud IAM and disabling individual object Access Control Lists (ACLs). Granting the predefined Storage Object Admin role at the bucket level allows the service account to perform necessary file management operations without exceeding least privilege requirements.

Adım Adım Çözüm

1
Analyze access control requirements under Uniform Bucket-Level Access (UBLA).
Determine that UBLA disables fine-grained object ACLs and relies solely on Cloud IAM policies.
When UBLA is enabled, ACL operations are ignored and rejected by Cloud Storage.
2
Assign principle-of-least-privilege IAM permissions.
Grant the Storage Object Admin role directly to the service account at the target bucket level.
This allows object creation, reading, and deletion within the specific bucket without granting excessive project-level access.
3
Remediate application code and activate UBLA.
Remove `gsutil acl` operations from the pipeline script and set UBLA on the bucket.
Removing ACL modification commands prevents runtime execution errors post-UBLA activation.

Anahtar Kavram

Uniform Bucket-Level Access (UBLA) unifies permissions exclusively through Cloud IAM roles and explicitly disables legacy Object ACL operations.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Configuring Storage Access Controls and Uniform Bucket-Level Access

Bu konudan daha fazla soru