By default, the contents of Cloud Storage buckets are not publicly available. You can, however, make an object or an entire bucket viewable by all. But sometimes neither of these approaches – totally blocking or totally allowing access – is the right one. Google Cloud offers a method for providing limited access to one or more individuals for a specified time: the signed URL. Anyone using the signed URL can access a secure bucket object for the predetermined period, regardless of whether they are in your organization or even have a Google account. In this hands-on lab, we’ll set up a bucket with an object that is not publicly available and then create the necessary structure – a service account with a private key – required to generate the signed URL.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Create a Cloud Storage Bucket and Copy the File to It
- Activate the Cloud Shell.
- When it spins up, create the necessary bucket.
gsutil mb -c regional -l us-east1 gs://[BUCKET_NAME](Note: The bucket name must be unique.)
- Clone the GitHub repository:
git clone https://github.com/linuxacademy/content-gcpro-security-engineer - Change directory to the
content-gcpro-security-engineer/signed-url-labfolder:
cd content-gcpro-security-engineer/signed-url-lab - Copy the file to the bucket:
gsutil cp restricted-logo.png gs://[BUCKET_NAME]
- Create a Service Account and Key
- In the Cloud Shell, run the following code to establish a variable:
export PROJECT_ID=[YOUR_PROJECT_ID] - Create a service account with the proper permissions:
gcloud iam service-accounts create la-service-account –display-name "LA Service Account"
gcloud projects add-iam-policy-binding ${PROJECT_ID} –member serviceAccount:la-service-account@${PROJECT_ID}.iam.gserviceaccount.com –role roles/viewer - Create a JSON key for authentication:
gcloud iam service-accounts keys create key.json –iam-account la-service-account@${PROJECT_ID}.iam.gserviceaccount.com
- In the Cloud Shell, run the following code to establish a variable:
- Generate a Signed URL
In the Cloud Shell, install the openssl headers for Debian GNU/Linux
sudo apt-get install build-essential libssl-dev libffi-dev python3-dev cargo- In the Cloud Shell, install the required library:
sudo -H pip3 install --upgrade pip sudo pip3 install pyopenssl - Generate the signed URL:
gsutil signurl -d 10m key.json gs://[BUCKET_NAME]/restricted-logo.png - Test the URL by clicking the generated link.
