I85PREP
⌘ K
ACE-Associate study materials
ACE-Associate study resources

Cross-Project Data Access for a Contractor

ACE-Associate · Put your knowledge to work in context.

All case studies

Cross-Project Data Access for a Contractor

A contractor from a partner company needs read access to objects in gs://acme-reports-prod for a 30-day engagement. Their identity is [email protected] in the partner's Google Workspace domain, which is not in your organization. The bucket is in project acme-data-prod. Your org policy forbids allUsers and allAuthenticatedUsers. The contractor must not be able to list other buckets in the project, and access must auto-expire. The security team also wants an audit trail of every object read.

1. What is the correct way to grant time-bound, least-privilege access to a non-org identity?

Read the worked answer

Use IAM Conditions with a time bound on a bucket-level grant, scoped to the specific bucket:

  • Grant roles/storage.objectViewer to [email protected] on gs://acme-reports-prod only (bucket-level IAM), not on the project. Bucket-level grants don't let her list other buckets.
  • Attach an IAM Condition with request.time < timestamp("<engagement end>") so the grant auto-expires - no manual cleanup.
  • Do not use allAuthenticatedUsers (org policy forbids it) and do not add her to a broad group.
  • Confirm the partner domain can be granted to: cross-domain IAM grants to individual identities are allowed even when the domain isn't in your org; verify with a gcloud storage buckets get-iam-policy test and a gsutil/gcloud storage ls from her account.

2. How do you satisfy the audit requirement for every object read?

Read the worked answer

Ensure Cloud Audit Logs Data Access logs are enabled for Cloud Storage in acme-data-prod. Admin Activity logs are on by default; Data Read logs are not, so explicitly enable DATA_READ for storage.googleapis.com in the project's audit config (or via org policy if centrally managed).

Then route logs to a destination the security team controls (log sink to a locked-down project or BigQuery dataset) so the contractor can't affect retention. Verify by reading one object as Alice and confirming a storage.objects.get DATA_READ entry appears with her principal. Note the cost/volume tradeoff of Data Access logs and scope to the bucket if needed.