Examkin

Soru

Zorluk: OrtaConfiguring Storage Access Controls and Uniform Bucket-Level Access

A software engineer receives an Access Denied error when running `gcloud storage cp file.txt gs://my-company-assets/ --canned-acl=public-read`. Upon inspecting the bucket configuration, you confirm that Uniform Bucket-Level Access (UBLA) is enabled on `my-company-assets`. According to Google Cloud security best practices, how should you grant public read access to the objects in this bucket?

  1. Grant the predefined Storage Object Viewer role (roles/storage.objectViewer) to allUsers on the bucket IAM policy.Cevap
  2. B
    Disable Uniform Bucket-Level Access on the bucket and re-run the upload command using the canned ACL flag.
  3. C
    Grant the primitive Viewer role (roles/viewer) to allUsers directly on the Cloud Storage bucket.
  4. D
    Apply an IAM deny policy at the Google Cloud project level for allUsers on storage.objects.get to override bucket permissions.

Cevap

Grant the predefined Storage Object Viewer role (roles/storage.objectViewer) to allUsers on the bucket IAM policy.
When Uniform Bucket-Level Access (UBLA) is enabled on a Cloud Storage bucket, individual object ACLs (such as canned ACLs) are disabled. All access control must be managed through Google Cloud IAM policies. To make all objects in the bucket publicly readable, security best practices dictate granting the predefined `Storage Object Viewer` (`roles/storage.objectViewer`) role to `allUsers` on the bucket's IAM policy.

Adım Adım Çözüm

1
Identify the cause of the command failure.
Uniform Bucket-Level Access (UBLA) disables per-object ACLs, rendering flags like `--canned-acl` invalid.
When UBLA is enabled, Cloud Storage relies exclusively on Cloud IAM for access management.
2
Select the appropriate access grant mechanism.
Assign an IAM role on the bucket for the public identity `allUsers`.
IAM bucket-level policies uniformly manage permissions across all objects stored in the bucket.
3
Apply the principle of least privilege.
Use `roles/storage.objectViewer` instead of primitive or project-wide roles.
The predefined `Storage Object Viewer` role limits access strictly to reading objects without granting excessive permissions.

Anahtar Kavram

Uniform Bucket-Level Access and IAM Access Control
Tahmini Süre:1m 15s
Bu soruyu puanla

Konular

Configuring Storage Access Controls and Uniform Bucket-Level Access

Bu konudan daha fazla soru