How do you give read-only access to a shared cloud storage bucket?

WHAT THIS TESTS: This question tests whether you understand Identity and Access Management for Cloud Storage at the bucket and object level, and whether you can design preventive controls rather than reactive ones. The interviewer wants to see that you think in terms of least privilege, bucket-level policy enforcement, and defense in depth for machine learning data pipelines.

A GOOD ANSWER COVERS: First, bind an IAM role limited to read permissions to the data scientist identity group at the bucket resource level rather than the project level. This limits scope to only the required bucket. Second, rely on bucket-level IAM policies through setIamPolicy and avoid depending on ObjectAccessControls or BucketAccessControls that could grant broader permissions to individual objects. Third, if the team uses Compute Engine or Kubernetes for training, mount the bucket via Cloud Storage FUSE or a similar read-only volume mount so that even compromised or misconfigured training code cannot issue delete or write calls. Fourth, mention that for extra protection you can enable retention policies that prevent deletion, though this is a secondary layer. Fifth, note that audit logging should be enabled to detect any access anomalies.

COMMON WRONG ANSWERS: A major red flag is suggesting project-level Editor or Owner roles because they are easy to assign. Another is relying on training documentation or human discipline instead of hard IAM constraints. Some candidates suggest copying data to individual buckets for each scientist; while this works, it misses the point of centralized governance and increases storage costs. Saying you would use bucket-level IAM but forgetting to avoid object-level access controls is also a gap because it leaves a backdoor.

LIKELY FOLLOW-UPS: The interviewer might ask how you would handle a scenario where data scientists need to write model checkpoints or intermediate artifacts. In that case, you would create a separate writeable bucket or prefix with a different role and keep the original training data strictly read-only. They might also ask how to handle a rogue admin or compromised service account, which leads to discussion of additional policy constraints and monitoring.

ONE CONCRETE EXAMPLE: Imagine a team of twenty data scientists sharing a bucket named company-ml-datasets. You create a Google Group called data-scientists@company.com. On the bucket IAM policy, you bind a read-only Cloud Storage role to that group. You ensure that object-level ACLs are not used so that no individual object grants extra privileges. On the training cluster startup script, you mount the bucket with Cloud Storage FUSE using flags set to read-only. Now the scientists can stream large datasets into training jobs, but any accidental removal or library bug that tries to overwrite an object receives a permission denied error at the IAM layer and at the filesystem layer.

Source: docs.cloud.google.com