Google Cloud Professional Data Engineer Exam

How is a user’s access to objects in a Cloud Storage bucket determined when using both IAM and ACLs?

1. The user has no access if IAM denies the permission.

2. The user only has access if both IAM and ACLs grant a permission.

3. The user has access if either IAM or ACLs grant a permission.

4. The user has no access if either IAM or ACLs deny a permission.

The correct answer is: The user has access if either IAM or ACLs grant a permission.

In Google Cloud Storage, access to objects within a bucket is governed by both Identity and Access Management (IAM) roles and Access Control Lists (ACLs). The correct understanding of how these two mechanisms interact is essential for managing permissions effectively. When considering user access, it is important to note that both IAM and ACLs evaluate permissions independently. If either IAM or ACLs grant a user permission to access an object, that user will be permitted to access it. This design allows for flexibility in granting access; for example, if IAM roles provide broad access to certain resources, users can still be granted specific access through ACLs for finer control over individual objects within a bucket, or vice versa. Thus, the user’s access is determined by the presence of a grant from either IAM or ACLs. If either mechanism allows access, the user is granted the ability to perform actions on that object. This means the system does not require both IAM and ACLs to grant permission, making this option the most accurate reflection of how access is determined in Google Cloud Storage.