Examkin

Soru

Zorluk: OrtaConfiguring Storage Access Controls and Uniform Bucket-Level Access

A cloud engineer needs to grant a service account read access to files stored in a Cloud Storage bucket named `customer-analytics-data`. Uniform Bucket-Level Access is currently enabled on the bucket. When an automated script attempts to apply fine-grained object Access Control Lists (ACLs) to grant read permission, the operation fails. Which action should the engineer take to properly grant the service account read access while adhering to Google Cloud security best practices?

  1. Grant the predefined Cloud Storage IAM role `roles/storage.objectViewer` to the service account at the bucket level.Cevap
  2. B
    Use `gcloud storage objects update` with a canned ACL of `projectPrivate` to override the Uniform Bucket-Level Access restriction on individual objects.
  3. C
    Grant the primitive `roles/viewer` role to the service account at the GCP project level so it inherits read permissions for all bucket objects.
  4. D
    Disable IAM policy inheritance on the bucket so object ACLs can override project-level access controls.

Cevap

Grant the predefined Cloud Storage IAM role `roles/storage.objectViewer` to the service account at the bucket level.
When Uniform Bucket-Level Access is enabled on a Cloud Storage bucket, access control lists (ACLs) are disabled, and Cloud IAM becomes the sole access control mechanism. The standard Google Cloud security recommendation is to grant predefined IAM roles (such as Storage Object Viewer) at the bucket level to provide necessary access following the principle of least privilege.

Adım Adım Çözüm

1
Identify the cause of the failure
Uniform Bucket-Level Access (UBLA) explicitly disables ACL evaluation and rejects per-object ACL operations.
UBLA simplifies security by ensuring all permissions are managed strictly through Cloud IAM.
2
Select the appropriate IAM permission model
Use Cloud IAM bucket-level role binding instead of object ACLs.
IAM roles apply uniformly to all objects in the bucket when UBLA is enabled.
3
Apply the principle of least privilege
Assign `roles/storage.objectViewer` to the specific service account at the bucket level rather than granting primitive roles at the project level.
Predefined roles restrict access specifically to Cloud Storage objects without exposing other project resources.

Anahtar Kavram

Uniform Bucket-Level Access & Cloud IAM Best Practices
Bu soruyu puanla

Konular

Configuring Storage Access Controls and Uniform Bucket-Level Access

Bu konudan daha fazla soru