Question

A financial services company stores sensitive customer statements in Cloud Storage buckets. During a security review, auditors find that individual objects have inconsistent legacy ACLs, making it impossible to reason about who can access data at scale. The security team wants to enforce access exclusively through IAM policies at the bucket level and eliminate per-object ACLs going forward, while ensuring the setting cannot be casually reverted by bucket owners. What should the architect recommend?

Accepted Answer

Enable uniform bucket-level access on the buckets and apply an organization policy constraint that enforces uniform bucket-level access on all new buckets.

Answer

Manually audit and remove all object ACLs weekly using a scheduled Cloud Function, keeping fine-grained access mode enabled.

Answer

Grant the Storage Object Viewer role to a single group and rely on signed URLs for all downstream object access.

Answer

Enable object versioning and turn on data access audit logs so ACL changes are recorded for later review.