A financial enterprise is deploying an automated transaction processing application on Compute Engine virtual machines (VMs). The application needs to read input batch files from a raw ingestion Cloud Storage bucket and write processed summary outputs to a designated archive bucket. The security architecture must satisfy the following compliance requirements: Centralize and simplify access governance by managing all permissions exclusively through Identity and Access Management (IAM) policies, disabling per-object Access Control Lists (ACLs). Follow the principle of least privilege for the Compute Engine workload without relying on default service accounts or broad basic roles. Grant the finance administrator group (grp-fin-admins@example.com) permission to administer bucket configurations and policies without granting full administrative rights across the entire project. Which combination of actions should the cloud architect recommend?

Enable Uniform Bucket-level Access on both buckets. Create a dedicated user-managed service account attached to the VMs, and grant it predefined Cloud Storage object roles on each bucket. Assign the Storage Admin predefined role to the finance administrator group on the buckets.: What Uniform Bucket-level Access and Dedicated IAM Roles Provide Uniform Bucket-level Access disables object-level Access Control Lists (ACLs) across a Cloud Storage bucket, ensuring that access to all objects in the bucket is managed uniformly and exclusively through Google Cloud Identity and Access Management (IAM). Coupling this with user-managed service accounts and predefined IAM roles establishes least-privilege security tailored to application workloads. How It Meets the Requirements Simplified and Centralized Administration: Enabling Uniform Bucket-level Access on the ingestion and archive buckets completely disables per-object ACLs. This ensures access is evaluated purely through Cloud IAM allow policies, eliminating configuration drift and unintended public exposure. Workload Least Privilege: Creating a dedicated user-managed service account attached to the Compute Engine instances replaces the overly broad default Compute Engine service account. Granting specific predefined roles (such as roles/storage.objectViewer on the raw data bucket and roles/storage.objectCreator or roles/storage.objectUser on the archive bucket) ensures the VM can only access required resources. Scoped Administrative Delegation: Granting the predefined Storage Admin role (roles/storage.admin) to grp-fin-admins@example.com at the bucket or storage level gives them full administrative control over storage resources without exposing project-wide management rights. Key Advantages and Capabilities Consistent Access Control: Prevents users and applications from accidentally or maliciously granting public or unauthorized access via object ACLs. Enhanced Auditability: All access determinations flow through IAM, simplifying compliance tracking with Cloud Audit Logs. Isolation of Application Identities: Single-purpose service accounts ensure that permissions do not accumulate across multiple distinct workloads. Fine-Grained Predefined Roles: Avoids high-privilege basic roles like roles/editor or roles/owner. Why This Is Optimal This solution adheres directly to Google Cloud security best practices by combining IAM-only bucket security with dedicated service accounts and role-based access control, eliminating the maintenance complexity of ACLs while strictly enforcing least privilege.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Storage Iam Uniform Access Service Account

Section: Security and access management

A financial enterprise is deploying an automated transaction processing application on Compute Engine virtual machines (VMs). The application needs to read input batch files from a raw ingestion Cloud Storage bucket and write processed summary outputs to a designated archive bucket.

The security architecture must satisfy the following compliance requirements:

Centralize and simplify access governance by managing all permissions exclusively through Identity and Access Management (IAM) policies, disabling per-object Access Control Lists (ACLs).
Follow the principle of least privilege for the Compute Engine workload without relying on default service accounts or broad basic roles.
Grant the finance administrator group (grp-fin-admins@example.com) permission to administer bucket configurations and policies without granting full administrative rights across the entire project.

Which combination of actions should the cloud architect recommend?

Enable Uniform Bucket-level Access on both buckets. Download a service account JSON private key, embed it in the VM startup script, and grant the service account the basic Viewer role at the project level.

Configure fine-grained access with object-level ACLs on both buckets. Use the Compute Engine default service account with the basic Editor role for the VMs, and assign the project-level Owner role to the finance administrator group.

Enable Uniform Bucket-level Access on both buckets. Create a dedicated user-managed service account attached to the VMs, and grant it predefined Cloud Storage object roles on each bucket. Assign the Storage Admin predefined role to the finance administrator group on the buckets.

Maintain fine-grained access on both buckets, and use Cloud Storage object ACLs to grant read access on raw files and write access on archive files. Grant the finance administrator group the project-level Editor role.

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Storage Iam Uniform Access Service Account

Section: Security and access management

The security architecture must satisfy the following compliance requirements:

Centralize and simplify access governance by managing all permissions exclusively through Identity and Access Management (IAM) policies, disabling per-object Access Control Lists (ACLs).
Follow the principle of least privilege for the Compute Engine workload without relying on default service accounts or broad basic roles.
Grant the finance administrator group (grp-fin-admins@example.com) permission to administer bucket configurations and policies without granting full administrative rights across the entire project.

Which combination of actions should the cloud architect recommend?

Explanations

What Uniform Bucket-level Access and Dedicated IAM Roles Provide

Uniform Bucket-level Access disables object-level Access Control Lists (ACLs) across a Cloud Storage bucket, ensuring that access to all objects in the bucket is managed uniformly and exclusively through Google Cloud Identity and Access Management (IAM). Coupling this with user-managed service accounts and predefined IAM roles establishes least-privilege security tailored to application workloads.

How It Meets the Requirements

Simplified and Centralized Administration: Enabling Uniform Bucket-level Access on the ingestion and archive buckets completely disables per-object ACLs. This ensures access is evaluated purely through Cloud IAM allow policies, eliminating configuration drift and unintended public exposure.
Workload Least Privilege: Creating a dedicated user-managed service account attached to the Compute Engine instances replaces the overly broad default Compute Engine service account. Granting specific predefined roles (such as roles/storage.objectViewer on the raw data bucket and roles/storage.objectCreator or roles/storage.objectUser on the archive bucket) ensures the VM can only access required resources.
Scoped Administrative Delegation: Granting the predefined Storage Admin role (roles/storage.admin) to grp-fin-admins@example.com at the bucket or storage level gives them full administrative control over storage resources without exposing project-wide management rights.

Key Advantages and Capabilities

Consistent Access Control: Prevents users and applications from accidentally or maliciously granting public or unauthorized access via object ACLs.
Enhanced Auditability: All access determinations flow through IAM, simplifying compliance tracking with Cloud Audit Logs.
Isolation of Application Identities: Single-purpose service accounts ensure that permissions do not accumulate across multiple distinct workloads.
Fine-Grained Predefined Roles: Avoids high-privilege basic roles like roles/editor or roles/owner.

Why This Is Optimal

This solution adheres directly to Google Cloud security best practices by combining IAM-only bucket security with dedicated service accounts and role-based access control, eliminating the maintenance complexity of ACLs while strictly enforcing least privilege.

View source documentation

Professional Cloud Architect

Cloud Storage Iam Uniform Access Service Account

Professional Cloud Architect

Cloud Storage Iam Uniform Access Service Account

What Uniform Bucket-level Access and Dedicated IAM Roles Provide

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions