Grant the export job what it needs and nothing else
A hands-on ACE lab. You produce the real artefact and 6 automated checks verify it behaves the way the exam expects.
- Certification
- ACE
- Format
- Structured configuration
- Difficulty
- medium
- Estimated time
- 12 min
- Automated checks
- 6
The brief
Rewrite bucket-policy.json so it grants exactly the access the review approved: the nightly export job creates objects in the bucket, and the analytics group reads and lists them. Nobody else gets anything. Two things are wrong and they are independent. The job holds a basic role, which is both broader than it needs and impossible to scope to a single bucket. And the exports are readable by anyone on the internet - note who was relying on that before you remove it. Write each principal with its type.
Part of ACE preparation
Labs are written by ExamNova to teach the decisions the exam tests. They are not reproductions of vendor lab content.