You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an object to always have full control of the object. However, you want to use Cloud Audit Logs to manage access to your bucket. What should you do?

Uniform bucket-level access simplifies permissions by disabling Access Control Lists (ACLs). All access control is governed solely by IAM, which applies uniformly to all objects within the bucket. This meets the requirements of not managing access per object and ensuring the uploader does not get special OWNER permissions, as object ACLs are disabled. This model also fully integrates with Cloud Audit Logs for access monitoring, providing a streamlined and secure management experience recommended by Google.

A. Setting an ACL with OWNER for allUsers is extremely insecure, granting full control of the bucket and its objects to anyone on the internet.
B. Setting an ACL with READER for allUsers is also insecure, as it makes all objects in the bucket publicly readable.
C. Using a default bucket ACL still operates in the fine-grained access model where object uploaders receive OWNER permission via ACLs, contradicting a key requirement.

1. Google Cloud Documentation, "Using uniform bucket-level access". It states, "When you enable uniform bucket-level access, ACLs are disabled... Access to Cloud Storage resources is granted exclusively through IAM."

2. Google Cloud Documentation, "Overview of access control". Under the "Should you use uniform bucket-level access?" section, it recommends this feature for uniform control over bucket resources.

3. Google Cloud Documentation, "IAM permissions for Cloud Storage". This page details the IAM roles used for access control when uniform bucket-level access is enabled.