A data engineering team is creating several new Google Cloud Storage buckets to store sensitive customer transaction records. To comply with internal security policies, the team must ensure that permissions are managed consistently across all objects in a bucket using only Cloud Identity and Access Management (Cloud IAM) policies, while completely disabling individual object-level Access Control Lists (ACLs). Which Cloud Storage access control configuration should the team implement?

Enable Uniform Bucket-Level Access on the Cloud Storage buckets: ### **What Uniform Bucket-Level Access is:** **Uniform Bucket-Level Access** (also known as uniform access) is a Google Cloud Storage security feature that unifies and simplifies access management. When enabled on a bucket, it completely disables object-level **Access Control Lists (ACLs)** and enforces access exclusively through **Cloud Identity and Access Management (Cloud IAM)** roles at the bucket, folder, or project level. ### **How it meets the compliance requirement:** - **Unified IAM permission model:** Automatically applies permissions uniformly to all objects within the bucket based on the principal's assigned IAM role (such as `roles/storage.objectViewer` or `roles/storage.objectAdmin`). - **Disables object-level ACLs:** Prevents individual object owners or users from granting permissions on specific files, eliminating configuration drift and unintended data exposure. - **Centralized governance:** Enables security administrators to manage access policies consistently from project or organization levels down to the bucket level. ### **Key advantages and capabilities:** - **Consistent security posture:** Ensures all current and future objects within the bucket inherit identical security policies. - **Auditability and compliance:** Simplifies compliance audits because permissions are evaluated strictly through centralized IAM audit logs rather than per-object ACL entries. - **Support for IAM Conditions:** Allows fine-grained conditions (e.g., resource tags, time-based access) to be enforced at the bucket level. - **Integration with Organization Policies:** Organizations can enforce Uniform Bucket-Level Access across all existing and newly created buckets using the `storage.uniformBucketLevelAccess` policy constraint. ### **Why this is optimal:** Uniform Bucket-Level Access is the Google Cloud recommended best practice for securing data storage. Compared to fine-grained ACLs, it guarantees that no object within a bucket can have separate, accidental public or unauthorized permissions attached to it.