Google Professional Cloud Security Engineer Question 122
Single answerGoogle Cloud PlatformYour organization uses a Google Cloud Storage bucket to store sensitive financial data. You have been tasked with ensuring that only members of the 'finance-team' group can access the bucket while minimizing permissions. How should you configure IAM and ACLs to meet this requirement?
- A
Grant the 'roles/storage.objectAdmin' IAM role to the 'finance-team' group at the bucket level and remove all ACL entries.
- B
Grant the 'roles/storage.objectViewer' IAM role to the 'finance-team' group at the bucket level and set the bucket's default ACL to 'private'.
- C
Grant the 'roles/storage.admin' IAM role to the 'finance-team' group at the project level and set the bucket's default ACL to 'public-read'.
- D
Grant the 'roles/storage.objectViewer' IAM role to the 'finance-team' group at the bucket level and explicitly add ACL entries for the 'finance-team' group for specific objects.
Show answer and explanation
Correct answer: B
Explanation
The most secure and scalable approach to manage access in Google Cloud Storage is to use IAM roles to control permissions at the bucket level. Granting 'roles/storage.objectViewer' to the 'finance-team' group ensures they have read-only access to the bucket while adhering to the principle of least privilege. Setting the default ACL to 'private' ensures that objects are not accidentally made public. This configuration minimizes complexity and aligns with best practices for managing access in Google Cloud.
- A. Incorrect.
This option grants overly broad permissions ('objectAdmin') to the 'finance-team' group, allowing them to modify objects, which violates the principle of least privilege. Additionally, removing all ACLs would not ensure fine-grained access control for existing data.
- B. Correct.
This option correctly grants the 'finance-team' group proper read-only access to the bucket by assigning the 'roles/storage.objectViewer' role at the bucket level. Setting the default ACL to 'private' ensures that objects are not publicly accessible, satisfying security requirements.
- C. Incorrect.
This option assigns the 'finance-team' group an overly permissive role ('storage.admin') at the project level, which is unnecessary and goes against the principle of least privilege. The 'public-read' ACL setting would make data accessible to everyone, violating the requirement to restrict access to the 'finance-team' group.
- D. Incorrect.
While this approach provides access to the 'finance-team' group, managing ACL entries for individual objects increases complexity and is unnecessary if IAM roles are properly configured. Using ACLs in this way is not recommended for simplicity and scalability.