Cross-Project Access for a Contractor
A contractor needs read access to Cloud Storage objects in a single bucket for 3 months. The bucket is in project data-prod, which also contains other buckets holding customer PII. The contractor has a personal Google account, not a company identity. Company policy says external identities must not receive project-level roles, and access must be time-bound and auditable. A manager suggests granting roles/storage.objectViewer at the project level because it is simpler. The security team wants to know exactly which objects the contractor accessed.
1. Design the least-privilege access grant and justify each choice.
Read the worked answer
Grant roles/storage.objectViewer on the specific bucket only, not the project. Project-level grants would expose every bucket in data-prod, including PII buckets, violating least privilege.
Details:
- Bind the role at the bucket resource, or use a conditional IAM binding with an expiry (
request.time < timestamp) to enforce the 3-month limit. - Because the identity is external, ensure Domain Restricted Sharing policy does not block the personal account; if it does, require the contractor to use a company-managed identity or a workforce identity federation account. This is a policy decision to raise, not silently bypass.
- The manager's project-level suggestion is rejected: it is broader than needed and conflicts with the external-identity policy.
Result: the contractor can read only the intended bucket's objects, and access expires automatically.
2. How do you satisfy the audit requirement for exactly which objects were accessed?
Read the worked answer
Enable Cloud Audit Logs Data Access logs for Cloud Storage on the bucket (or project). Admin Activity logs do not record object reads; Data Access logs do.
Steps:
- Enable Data Access logging for
storage.googleapis.com(OBJECT_READ) scoped to the project or bucket. - Create a log sink to a locked Cloud Storage bucket or BigQuery dataset in a separate audit project, so the contractor cannot alter logs.
- Query by the contractor's principal to produce the object-access report.
Note that Data Access logs increase log volume and cost, so scope them to the relevant bucket if possible. This gives an exact, tamper-resistant record of object reads for the 3-month period.