The correct answer is B (roles/storage.admin) because it grants team members full control over buckets and objects, but only within the specified bucket when applied individually. This aligns with the principle of least privilege by not granting unnecessary permissions.

• A (roles/storage.objectCreator) and D (roles/storage.objectAdmin) are incorrect as they do not provide sufficient privileges for bucket management.
• C (roles/owner) is incorrect as it offers more privileges than needed, violating the principle of least privilege.

For more details, refer to the GCP documentation on Cloud Storage IAM Roles.