Question

A security engineer at a financial services company must ensure that every new and existing Cloud Storage bucket across all projects in the organization cannot use fine-grained (object-level ACL) permissions, forcing all access to be governed exclusively through IAM. Auditors require this to be enforced centrally so individual project owners cannot opt out. What should the engineer do?

Accepted Answer

Apply the 'constraints/storage.uniformBucketLevelAccess' boolean organization policy constraint at the organization node and set it to enforced.

Answer

Grant the 'roles/storage.admin' role to the security team at the organization level and have them manually toggle uniform bucket-level access on each bucket.

Answer

Create an IAM deny policy at the organization level that blocks the 'storage.buckets.setIamPolicy' permission for all project owners.

Answer

Enable the 'constraints/gcp.resourceLocations' list constraint and restrict it to buckets that already have uniform access configured.