Google Associate Cloud Engineer Question 233
Select 3Google Cloud PlatformYou are tasked with setting up a Google Cloud Storage bucket to store confidential business documents. The documents should only be accessible to members of the 'finance-team' group within your organization. Moreover, you want to ensure that any accidental public access is prevented. Which combination of steps should you take to achieve this?
- A
A. Enable 'Uniform bucket-level access' on the bucket.
- B
B. Set the bucket's IAM policy to grant 'roles/storage.objectViewer' to the 'finance-team' group.
- C
C. Enable 'Public access prevention' on the bucket.
- D
D. Add a bucket policy to deny all users except the 'finance-team' group.
- E
E. Use Signed URLs to provide temporary access to the objects in the bucket.
Show answer and explanation
Correct answers: A, B, C
Explanation
To securely manage and restrict access to the confidential documents in the Google Cloud Storage bucket, you need to enforce access control at the bucket level using IAM, while preventing any accidental public access. Enabling 'Uniform bucket-level access' and 'Public access prevention' ensures consistent and restricted access management. Granting 'roles/storage.objectViewer' to the 'finance-team' group allows only authorized users to access the documents. Using these combined measures provides robust security and aligns with the organization's access policies.
- A. Correct.
A. Enabling 'Uniform bucket-level access' ensures that IAM policies apply uniformly to all objects in the bucket, simplifying access management and preventing accidental individual object ACL permissions.
- B. Correct.
B. By granting 'roles/storage.objectViewer' to the 'finance-team' group, you ensure that only members of this group have read access to the objects in the bucket.
- C. Correct.
C. Enabling 'Public access prevention' ensures that no public access can be granted to the bucket or its objects, adding a layer of security to prevent accidental exposure.
- D. Incorrect.
D. While a bucket policy could be used to enforce access control, Google Cloud Storage recommends using IAM for setting access policies over bucket policies for better integration and maintenance.
- E. Incorrect.
E. Signed URLs are used to provide limited-time access to objects, but this does not align with the requirement to restrict access to a specific group consistently.