An analytics team in your organization is creating multiple Google Cloud Storage buckets to store raw enterprise datasets. The security compliance team mandates that access permissions must be managed centrally and consistently across all objects within each bucket using Cloud Identity and Access Management (IAM) roles, rather than allowing individual object-level Access Control Lists (ACLs). Which Cloud Storage access control configuration should you implement to satisfy this requirement?

Enable Uniform Bucket-Level Access on the Cloud Storage buckets: ### **What Uniform Bucket-Level Access is:** **Uniform Bucket-Level Access** is a Cloud Storage security feature that unifies access management by enforcing permissions exclusively through **Cloud Identity and Access Management (IAM)**. When enabled on a bucket, Cloud Storage disables object-level **Access Control Lists (ACLs)**, ensuring that permissions granted at the bucket level automatically and uniformly apply to every single object stored inside that bucket. ### **How it meets the requirements:** - **Centrally managed permissions (✓):** Access is controlled strictly via standard **Cloud IAM roles** (such as `Storage Object Viewer` or `Storage Object User`), eliminating complex object-level permission disparities. - **Disables individual object ACLs (✓):** Enforcing uniform access deactivates ACL evaluation completely, preventing individual users or automated tools from creating custom, unmonitored object permissions. - **Prevents inadvertent data exposure (✓):** By standardizing access at the bucket boundary, administrators avoid unintended public or private leaks caused by misconfigured per-object ACLs. ### **Key advantages and capabilities:** - **Consistent governance:** Simplifies security auditing by providing a single point of policy enforcement across all objects. - **Enhanced security integration:** Works seamlessly with organizational security features such as **Domain Restricted Sharing** and **VPC Service Controls**. - **Simplified management:** Eliminates the administrative overhead of tracking and modifying permissions on individual files or prefixes. - **Role inheritance:** Ensures newly uploaded objects instantly inherit the access policies defined at the bucket and project levels without manual intervention. ### **Why this is optimal:** Enabling **Uniform Bucket-Level Access** directly aligns with Google Cloud's security best practices for enterprise data governance. It replaces legacy, dual-layer authorization (IAM combined with ACLs) with a modern, uniform IAM-only model, ensuring full visibility and compliance across storage resources.