Migrate Gcs Legacy Acls To Uniform Bucket Level Access

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise security engineer is auditing legacy Google Cloud Storage buckets that contain sensitive data. Currently, access to files within the buckets is governed by a combination of legacy Object Access Control Lists (ACLs) and Cloud IAM role bindings. The security team mandates that object-level ACLs must be eliminated in favor of centralized IAM policy enforcement to prevent permission drift and simplify compliance auditing.

Which strategy should the security engineer implement to transition the buckets to Uniform Bucket-Level Access (UBLA) without disrupting access for authorized users?

Enable Cloud Storage Bucket Lock with a retention policy to automatically convert existing object-level ACLs into bucket IAM policies.

Reset bucket ACLs to private using legacy gsutil/gcloud commands, assign Storage Admin roles at the project level, and re-upload all objects to clear legacy ACL entries.

Analyze existing ACL usage via Cloud Audit Logs, grant equivalent IAM roles (such as Storage Object Viewer or Storage Object Admin) at the bucket level to authorized principals, and enable Uniform Bucket-Level Access on the bucket.

Modify individual object metadata to apply the roles/storage.legacyObjectOwner IAM role directly to objects, and then enforce an Organization Policy constraint across the project.

Professional Cloud Security Engineer

Migrate Gcs Legacy Acls To Uniform Bucket Level Access

Related questions