Migrate Gcs Legacy Acls To Uniform Bucket Level Access

What Uniform Bucket-Level Access Is

Uniform Bucket-Level Access (UBLA) is a Cloud Storage security feature that unifies and simplifies access management by enforcing permissions exclusively through Identity and Access Management (IAM). When UBLA is enabled on a bucket, Cloud Storage ignores all existing object-level and bucket-level Access Control Lists (ACLs), ensuring that access is granted solely through IAM policies defined at the bucket, folder, project, or organization level.

How It Meets the Requirements

• Preventing Unauthorized Disruptions: Reviewing access history and ACL usage via Cloud Audit Logs ensures administrators identify all principals who rely on legacy object ACLs to access files.
• Centralizing Permissions: Granting equivalent Cloud IAM roles—such as Storage Object Viewer (roles/storage.objectViewer) or Storage Object Admin (roles/storage.objectAdmin)—at the bucket level ensures legitimate users retain required read/write permissions.
• Eliminating Object ACLs: Enabling UBLA disables the evaluation of object-level ACLs across all objects within the bucket, bringing all authorization decisions under standard, auditable IAM policies.

Key Advantages and Capabilities

• Consistent Security Model: Enforces uniform access policies across all objects in the bucket, eliminating hidden permissions granted directly on individual objects.
• Simplified Auditing: Consolidates access evaluation into IAM policies and IAM condition bindings, reducing administrative overhead.
• Integration with Security Guardrails: Enables full compatibility with advanced security features such as VPC Service Controls, IAM Conditions, and Organization Policies.
• Reversibility Window: For standard implementations, UBLA allows a 90-day evaluation window during which it can be disabled if unexpected access issues arise, before it can be permanently locked.

Why This Is Optimal

This approach follows Google Cloud best practices for IAM migration. It proactively maps out legacy access patterns, grants appropriate least-privilege IAM roles at the bucket resource level, and cleanly deactivates object-level ACL parsing by enabling UBLA.