A security administrator is standardizing access controls on a Cloud Storage bucket named `financial-reports-archive` to align with organizational security guidelines. The bucket currently contains objects with legacy fine-grained Access Control Lists (ACLs), but company policy requires that all access be managed exclusively through Cloud IAM permissions. Which TWO configuration steps must the administrator perform to achieve this requirement following Google Cloud security best practices? (Select TWO.)
- Enable Uniform Bucket-Level Access on the bucket to disable Access Control Lists (ACLs) across all objects.Cevap
- Assign predefined Cloud IAM roles, such as Storage Object Viewer or Storage Object Admin, to principals at the bucket or project level.Cevap
- CApply per-object Access Control List (ACL) read entries to individual financial documents using Cloud Storage commands.
- DGrant the primitive Editor role to authorized team members at the bucket level to override existing object ACLs.
Cevap
Enabling Uniform Bucket-Level Access on the target Cloud Storage bucket and granting predefined IAM roles (such as Storage Object Viewer) at the bucket or project level.
To standardize storage access controls to Cloud IAM only, administrators must enable Uniform Bucket-Level Access on the bucket. This action disables per-object ACLs, ensuring all object access is controlled via IAM permissions. Combining this setting with specific predefined roles (such as Storage Object Viewer) ensures least-privilege permissions managed centrally.
Adım Adım Çözüm
Anahtar Kavram
Uniform Bucket-Level Access (UBLA) and IAM Access Management