A data engineering team is setting up Cloud Storage buckets to host raw and processed datasets. The security team requires a centralized, simplified security model that prevents individual object-level Access Control Lists (ACLs) from overriding organizational policies, ensuring that permissions are governed exclusively through hierarchical Identity and Access Management (IAM) roles. Which Cloud Storage access control configuration should the team implement to satisfy these security requirements?

Enable Uniform Bucket-Level Access on the buckets to disable ACLs and manage all permissions exclusively through IAM.: ### **What Uniform Bucket-Level Access is** **Uniform Bucket-Level Access** is a Cloud Storage security feature that unifies and simplifies access management by disabling **Access Control Lists (ACLs)** for a bucket and all of its contained objects. When enabled, access to objects is evaluated strictly through **Identity and Access Management (IAM)** policies defined at the bucket level or inherited from higher levels in the resource hierarchy. ### **How it meets the requirements** - **Exclusively relies on IAM:** Enabling Uniform Bucket-Level Access completely deactivates ACL evaluation, preventing object-level permissions from being assigned or modified independently. - **Enforces hierarchical governance:** IAM permissions assigned at parent resource levels (such as **Organizations**, **Folders**, or **Projects**) or directly at the **Bucket level** apply consistently to all objects inside the bucket. - **Prevents permission drift:** Object uploaders cannot grant unauthorized third-party read/write permissions via object ACLs, eliminating inconsistent security configurations across individual files. ### **Key advantages and capabilities** - **Consistent permission model:** Aligns Cloud Storage with the standard Google Cloud IAM model used across other services like BigQuery and Compute Engine. - **Simplified auditing and compliance:** Security administrators can audit access by inspecting bucket and project IAM policies rather than parsing ACLs across millions of distinct objects. - **Integration with advanced security features:** Enables support for IAM Conditions, VPC Service Controls, and Organization Policies that enforce uniform access across all organization buckets. - **Reduced administrative overhead:** Eliminates the need to maintain, inspect, and update object-level access metadata. ### **Why this is optimal** Uniform Bucket-Level Access is the Google Cloud recommended best practice for securing data buckets. It removes the dual-system complexity of managing both IAM policies and legacy ACLs simultaneously, ensuring that all access decisions follow centralized, hierarchical governance.