Uniform bucket-level access vs ACLs: How to avoid accidental public exposure?

Goal

Enable uniform bucket-level access on an existing Google Cloud Storage bucket while ensuring that no objects become publicly readable and that existing ACL‑based permissions are preserved.

Constraints & Uncertainty

When uniform bucket‑level access is turned on, ACLs are disabled and only IAM permissions apply. Existing object‑level ACLs that granted public read access could be unintentionally revoked or left unprotected if IAM roles are not correctly assigned. Additionally, the 90‑day immutability period for disabling the feature adds a risk if migration is incomplete.

Specific Questions

• How can I verify that no object in the bucket is publicly readable after enabling uniform bucket-level access?
• What is the recommended approach to migrate existing object ACLs that grant public access to equivalent IAM roles without exposing the data?
• Are there any audit or monitoring metrics that can confirm the transition has succeeded without accidental public exposure?