A security team enables Uniform Bucket-Level Access (UBLA) on a Google Cloud Storage bucket storing sensitive financial reports. Consequently, legacy automated pipelines attempting to apply per-object Access Control Lists (ACLs) fail. You must grant a financial auditor read access to objects in this bucket while maintaining organizational compliance and least privilege principles. Which TWO actions should you take?
- Grant the auditor the predefined Storage Object Viewer role (roles/storage.objectViewer) on the Cloud Storage bucket via Cloud IAM.Cevap
- Refactor data ingestion workflows to rely exclusively on Cloud IAM policies rather than setting per-object ACL flags.Cevap
- CAssign the primitive Viewer role (roles/viewer) to the auditor at the GCP project level.
- DDisable Uniform Bucket-Level Access on the storage bucket to restore support for per-object ACLs.
Cevap
The correct actions are granting the predefined Storage Object Viewer role (roles/storage.objectViewer) at the bucket level using IAM, and refactoring ingestion workflows to manage access via IAM policies rather than per-object ACLs.
Enabling Uniform Bucket-Level Access (UBLA) centralizes permissions management strictly through Google Cloud IAM, ignoring individual object ACLs. Assigning the predefined Storage Object Viewer role (roles/storage.objectViewer) to the auditor satisfies read requirements under the principle of least privilege. Additionally, updating ingestion pipelines to use IAM policies prevents automated pipeline failure caused by forbidden ACL assignments under UBLA.
Adım Adım Çözüm
Anahtar Kavram
Uniform Bucket-Level Access (UBLA) disables per-object ACLs in Google Cloud Storage and enforces Cloud IAM predefined roles for bucket security management.