Signed URLs for temporary access in GCP - Commands & Configuration

Introduction

Sometimes you want to let someone access a file in your cloud storage for a short time without giving them full permission. Signed URLs let you create a special link that works only for a limited time to solve this.

When you want to share a private file with a friend for just a few hours.

When your app needs to let users download files securely without making them public.

When you want to give temporary upload access to a storage bucket without opening it fully.

When you want to avoid managing user accounts but still control file access.

When you want to track who accessed a file by giving unique signed URLs.

Commands

This command logs you in using a service account that has permission to create signed URLs. You need this to generate the URL securely.

Terminal

gcloud auth activate-service-account [e-mail] --key-file=service-account-key.json

Expected Output

Activated service account credentials for: [[e-mail]]

→

--key-file - Specifies the JSON key file for the service account

This command creates a signed URL for the file 'my-file.txt' in the bucket 'example-bucket' that will work for 1 hour.

Terminal

gsutil signurl -d 1h service-account-key.json gs://example-bucket/my-file.txt

Expected Output

URL:

https://storage.googleapis.com/example-bucket/my-file.txt?X-Goog-Algorithm=GOOG4-RSA-SHA256&X-Goog-Credential=signed-url-user%40example-project.iam.gserviceaccount.com%2F20240601%2Fauto%2Fstorage%2Fgoog4_request&X-Goog-Date=20240601T000000Z&X-Goog-Expires=3600&X-Goog-SignedHeaders=host&X-Goog-Signature=abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890

→

-d - Sets how long the signed URL will be valid

This command uses the signed URL to download the file. It shows that the URL works and gives temporary access.

Terminal

curl "https://storage.googleapis.com/example-bucket/my-file.txt?X-Goog-Algorithm=GOOG4-RSA-SHA256&X-Goog-Credential=signed-url-user%40example-project.iam.gserviceaccount.com%2F20240601%2Fauto%2Fstorage%2Fgoog4_request&X-Goog-Date=20240601T000000Z&X-Goog-Expires=3600&X-Goog-SignedHeaders=host&X-Goog-Signature=abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890"

Expected Output

This is the content of my-file.txt

Key Concept

If you remember nothing else from this pattern, remember: signed URLs let you share private files safely for a short time without changing permissions.

Common Mistakes

Using a signed URL after it has expired

The URL stops working after the set time, so access is denied.

Generate a new signed URL with a fresh expiration time when access is needed again.

Not using a service account with proper permissions to create signed URLs

The command to create signed URLs will fail due to lack of permission.

Use a service account with the 'roles/storage.objectViewer' or similar role to generate signed URLs.

Sharing the signed URL publicly for longer than intended

Anyone with the URL can access the file until it expires, risking unwanted access.

Keep signed URLs private and set short expiration times to limit exposure.

Summary

Activate a service account with permission to create signed URLs.

Use the gsutil signurl command to generate a temporary URL for a file.

Use the signed URL to access the file securely for the limited time.

Practice

1. What is the main purpose of a signed URL in Google Cloud Storage?

easy

A. To permanently make a file public to everyone

B. To encrypt a file stored in the bucket

C. To provide temporary, secure access to a file without making it public

D. To delete a file from the bucket automatically

Solution

1. Step 1: Understand what signed URLs do

   Signed URLs allow access to a file for a limited time without changing its public status.

2. Step 2: Compare options

   Only To provide temporary, secure access to a file without making it public describes temporary, secure access without making the file public.

3. Final Answer:

   To provide temporary, secure access to a file without making it public -> Option C

4. Quick Check:

   Signed URL = Temporary secure access [OK]

Hint: Signed URLs = temporary access without public exposure [OK]

Common Mistakes:

• Thinking signed URLs make files permanently public
• Confusing signed URLs with encryption
• Assuming signed URLs delete files

2. Which gcloud command correctly creates a signed URL valid for 1 hour to download a file named photo.jpg from bucket my-bucket?

easy

A. gcloud storage signed-urls create gs://my-bucket/photo.jpg --duration=1h

B. gcloud storage signed-url create gs://my-bucket/photo.jpg --valid-for=1h

C. gcloud storage signed-url generate gs://my-bucket/photo.jpg --duration=60m

D. gcloud storage url-sign create gs://my-bucket/photo.jpg --time=1h

Solution

1. Step 1: Identify correct command syntax

   The correct command uses 'gcloud storage signed-urls create' with '--duration' to specify time.

2. Step 2: Check options for correct flags and command

   gcloud storage signed-urls create gs://my-bucket/photo.jpg --duration=1h matches the correct syntax and flag '--duration=1h'. Others use wrong flags or commands.

3. Final Answer:

   gcloud storage signed-urls create gs://my-bucket/photo.jpg --duration=1h -> Option A

4. Quick Check:

   Correct command + --duration flag = gcloud storage signed-urls create gs://my-bucket/photo.jpg --duration=1h [OK]

Hint: Use 'signed-urls create' with '--duration' for time [OK]

Common Mistakes:

• Using incorrect flags like --valid-for or --time
• Using 'generate' instead of 'create'
• Mixing command order or bucket syntax

3. What will happen if you try to use a signed URL after its expiration time?

medium

A. The signed URL will return an error indicating access denied

B. The file will be accessible without restrictions

C. The signed URL will automatically renew for another period

D. The file will be deleted from the bucket

Solution

1. Step 1: Understand signed URL expiration

   Signed URLs only allow access during their valid time window.

2. Step 2: Identify behavior after expiration

   After expiration, access is denied and an error is returned.

3. Final Answer:

   The signed URL will return an error indicating access denied -> Option A

4. Quick Check:

   Expired signed URL = Access denied error [OK]

Hint: Expired signed URLs deny access with error [OK]

Common Mistakes:

• Assuming URLs auto-renew after expiration
• Thinking files become public after expiration
• Believing files get deleted automatically

4. You created a signed URL with the command gcloud storage signed-urls create gs://my-bucket/file.txt --duration=30m, but users report they cannot access the file. What is the most likely cause?

medium

A. The bucket name is incorrect or does not exist

B. The file file.txt is missing or misspelled in the bucket

C. The signed URL duration is too long

D. Signed URLs do not work for text files

Solution

1. Step 1: Check bucket and file existence

   If the file name is wrong or missing, access via signed URL fails.

2. Step 2: Evaluate other options

   Bucket name error would cause different error; duration too long is allowed; file type does not restrict signed URLs.

3. Final Answer:

   The file file.txt is missing or misspelled in the bucket -> Option B

4. Quick Check:

   Missing file = Access failure [OK]

Hint: Check file name and existence if signed URL fails [OK]

Common Mistakes:

• Assuming duration too long blocks access
• Believing signed URLs depend on file type
• Ignoring typos in file or bucket names

5. You want to share a file securely with a partner for exactly 2 hours, but only allow them to upload a new version, not download the existing one. Which approach using signed URLs is best?

hard

A. Create a signed URL with DELETE method and 2-hour duration

B. Create a signed URL with GET method and 2-hour duration for downloading

C. Make the file public and send the link

D. Create a signed URL with PUT method and 2-hour duration for uploading

Solution

1. Step 1: Understand HTTP methods for signed URLs

   PUT allows uploading or replacing a file; GET allows downloading; DELETE removes the file.

2. Step 2: Match requirement to method

   To allow upload but not download, use a signed URL with PUT method and set duration to 2 hours.

3. Final Answer:

   Create a signed URL with PUT method and 2-hour duration for uploading -> Option D

4. Quick Check:

   Upload access = PUT method signed URL [OK]

Hint: Use PUT signed URL to allow upload only [OK]

Common Mistakes:

• Using GET method which allows download
• Making file public exposes it permanently
• Using DELETE method deletes the file