Diagram
A decision tree that evaluates who can access a Cloud Storage object: first checking for an IAM deny policy, then whether uniform bucket-level access is enabled, and finally checking IAM policies and object ACLs in parallel, where either system granting permission allows access.
How IAM Policies and ACLs Work Together
How IAM Policies and ACLs work together determines who can actually reach data when both systems are active. Cloud Storage grants access when either system allows it, so permissions granted by IAM do not appear in ACLs and permissions granted by ACLs do not appear in IAM. This means an evaluator must check project-level IAM, bucket-level IAM, and object ACLs to know the full access for an object.
One exception is Legacy Bucket roles, which stay synchronized with bucket ACLs in both directions. Adding or removing a Legacy Bucket IAM role updates the matching bucket ACL, and changing that bucket ACL updates the matching IAM role:
Domain 2 of 3
29 practice questions
Practice this DomainLast updated