GCP Professional Cloud Security Engineer Practice Question

Your organization enforces Public Access Prevention and uniform bucket-level access on every Cloud Storage bucket. A nightly Dataflow pipeline runs with the service account "[email protected]" and must download objects whose names start with "exports/" in the bucket "corp-fin-raw". The job must not be able to list objects outside that prefix or view bucket metadata, and no other identities should gain new permissions. Which IAM binding applied on the bucket provides the required access with the principle of least privilege?

Grant roles/storage.objectViewer to the service account at the project level so it inherits download rights to all buckets in the project.
Add a bucket-level IAM binding that grants the service account roles/storage.objectViewer with a condition: resource.name.startsWith("projects/_/buckets/corp-fin-raw/objects/exports/").
Use object ACLs to grant the service account roles/storage.legacyObjectReader on every object inside the "exports/" prefix.
Grant roles/storage.objectAdmin on the bucket with a condition limiting resource.name to the "exports/" prefix.

Report Issue

Answer Description

The roles/storage.objectViewer role grants only read (download) permission on objects, without the ability to write, delete, or change bucket settings. When it is bound at the bucket level with an IAM condition that restricts the resource name to the path that begins with "projects/_/buckets/corp-fin-raw/objects/exports/", the service account can read objects whose names start with "exports/" but cannot list or access any other objects. IAM conditions are respected under uniform bucket-level access, so legacy ACLs cannot be used. Granting the role at the project scope would expose other buckets, while granting roles/storage.objectAdmin would add unnecessary write privileges. Legacy ACLs (roles/storage.legacyObjectReader) are ignored once uniform bucket-level access is enabled, so they would not satisfy the requirement.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.