A DevOps team configures a central Cloud Storage bucket named `invoice-processing-2026` to store incoming billing documents. To comply with corporate security standards, Uniform Bucket-Level Access (UBLA) has been enabled on the bucket. Shortly after, an automated data ingestion script fails with a permissions error when attempting to upload a document while specifying a fine-grained object Access Control List (ACL). Which action should the cloud engineer take to enable successful uploads while maintaining compliance with the security policy?
- Update the ingestion script to omit object-level ACL requests and ensure the service account is granted an appropriate IAM role, such as Storage Object Creator, on the bucket.Cevap
- BDisable Uniform Bucket-Level Access on the bucket, execute the script to apply object-level ACLs, and then re-enable Uniform Bucket-Level Access.
- CGrant the primitive Editor role to the ingestion service account at the GCP project level so that it can bypass Uniform Bucket-Level Access enforcement.
- DRevoke IAM Storage roles at the bucket level so that individual object ACL grants specified in the script take precedence.
Cevap
Update the ingestion script to omit object-level ACL requests and ensure the service account is granted an appropriate IAM role, such as Storage Object Creator, on the bucket.
Enabling Uniform Bucket-Level Access (UBLA) unifies access control under Cloud IAM and disables legacy per-object ACLs. To resolve upload failures caused by an application specifying object ACLs, the application code must be updated to upload objects without ACL parameters, and the service account must be granted an appropriate predefined IAM role (such as Storage Object Creator).
Adım Adım Çözüm
Anahtar Kavram
Uniform Bucket-Level Access (UBLA) disables fine-grained Object ACLs in favor of centralized Cloud IAM policies.