You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an…

Question

Options

• ASet up an ACL with OWNER permission to a scope of allUsers.
• BSet up an ACL with READER permission to a scope of allUsers.
• CSet up a default bucket ACL and manage access for users using IAM.
• DSet up Uniform bucket-level access on the Cloud Storage bucket and manage access for users

• A
  6% (1)
• B
  13% (2)
• D
  81% (13)

Explanation

Uniform bucket-level access (formerly 'Bucket Policy Only') disables per-object ACLs and enforces access control solely through IAM policies applied at the bucket level. This satisfies all three requirements: (1) access is managed at the bucket level rather than per-object, (2) object uploaders no longer automatically receive OWNER control via legacy ACLs, and (3) Cloud Audit Logs integration works correctly with uniform access - in fact, Google requires uniform bucket-level access to be enabled to get complete Data Access audit logs for Cloud Storage. Options A and B set ACLs granting access to allUsers, which is public access - a security violation. Option C describes a default bucket ACL combined with IAM, which is a mixed model and does not eliminate the uploader-owns-object problem.

No community discussion yet for this question.