A financial enterprise is deploying an automated transaction processing application on Compute Engine virtual machines (VMs). The application needs to read input batch files from a raw ingestion Cloud Storage bucket and write processed summary outputs to a designated archive bucket. The security architecture must satisfy the following compliance requirements: Centralize and simplify access governance by managing all permissions exclusively through Identity and Access Management (IAM) policies, disabling per-object Access Control Lists (ACLs). Follow the principle of least privilege for the Compute Engine workload without relying on default service accounts or broad basic roles. Grant the finance administrator group (grp-fin-admins@example.com) permission to administer bucket configurations and policies without granting full administrative rights across the entire project. Which combination of actions should the cloud architect recommend?

Enable Uniform Bucket-level Access on both buckets. Create a dedicated user-managed service account attached to the VMs, and grant it predefined Cloud Storage object roles on each bucket. Assign the Storage Admin predefined role to the finance administrator group on the buckets.: ### What Uniform Bucket-level Access and Dedicated IAM Roles Provide **Uniform Bucket-level Access** disables object-level Access Control Lists (ACLs) across a Cloud Storage bucket, ensuring that access to all objects in the bucket is managed uniformly and exclusively through **Google Cloud Identity and Access Management (IAM)**. Coupling this with **user-managed service accounts** and **predefined IAM roles** establishes least-privilege security tailored to application workloads. ### How It Meets the Requirements - **Simplified and Centralized Administration**: Enabling **Uniform Bucket-level Access** on the ingestion and archive buckets completely disables per-object ACLs. This ensures access is evaluated purely through Cloud IAM allow policies, eliminating configuration drift and unintended public exposure. - **Workload Least Privilege**: Creating a dedicated **user-managed service account** attached to the Compute Engine instances replaces the overly broad default Compute Engine service account. Granting specific predefined roles (such as `roles/storage.objectViewer` on the raw data bucket and `roles/storage.objectCreator` or `roles/storage.objectUser` on the archive bucket) ensures the VM can only access required resources. - **Scoped Administrative Delegation**: Granting the predefined **Storage Admin** role (`roles/storage.admin`) to `grp-fin-admins@example.com` at the bucket or storage level gives them full administrative control over storage resources without exposing project-wide management rights. ### Key Advantages and Capabilities - **Consistent Access Control**: Prevents users and applications from accidentally or maliciously granting public or unauthorized access via object ACLs. - **Enhanced Auditability**: All access determinations flow through IAM, simplifying compliance tracking with **Cloud Audit Logs**. - **Isolation of Application Identities**: Single-purpose service accounts ensure that permissions do not accumulate across multiple distinct workloads. - **Fine-Grained Predefined Roles**: Avoids high-privilege basic roles like `roles/editor` or `roles/owner`. ### Why This Is Optimal This solution adheres directly to Google Cloud security best practices by combining IAM-only bucket security with dedicated service accounts and role-based access control, eliminating the maintenance complexity of ACLs while strictly enforcing least privilege.

StudyCerts

Cloud Storage Iam Uniform Access Service Account | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Storage Iam Uniform Access Service Account

Section: Security and access management

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise is deploying an automated transaction processing application on Compute Engine virtual machines (VMs). The application needs to read input batch files from a raw ingestion Cloud Storage bucket and write processed summary outputs to a designated archive bucket.

The security architecture must satisfy the following compliance requirements:

Centralize and simplify access governance by managing all permissions exclusively through Identity and Access Management (IAM) policies, disabling per-object Access Control Lists (ACLs).
Follow the principle of least privilege for the Compute Engine workload without relying on default service accounts or broad basic roles.
Grant the finance administrator group (grp-fin-admins@example.com) permission to administer bucket configurations and policies without granting full administrative rights across the entire project.

Which combination of actions should the cloud architect recommend?

Configure fine-grained access with object-level ACLs on both buckets. Use the Compute Engine default service account with the basic Editor role for the VMs, and assign the project-level Owner role to the finance administrator group.

Maintain fine-grained access on both buckets, and use Cloud Storage object ACLs to grant read access on raw files and write access on archive files. Grant the finance administrator group the project-level Editor role.

Enable Uniform Bucket-level Access on both buckets. Download a service account JSON private key, embed it in the VM startup script, and grant the service account the basic Viewer role at the project level.

Enable Uniform Bucket-level Access on both buckets. Create a dedicated user-managed service account attached to the VMs, and grant it predefined Cloud Storage object roles on each bucket. Assign the Storage Admin predefined role to the finance administrator group on the buckets.

Professional Cloud Architect

Cloud Storage Iam Uniform Access Service Account

Related questions