CODEWITHSUNDEEP
google-cloud-platformgoogle-cloud-storagegoogle-iam
pdoherty926
pdoherty926

Reputation: 10349

Is it possible to make Cloud Storage objects visible to users authenticated via application?

As it stands, my web application allows end-users to upload images to Google Cloud Storage using signed URLs which are generated on the back-end.

I'd like to also make these objects visible to these users after they've been uploaded. The simplest solution I can imagine would be to allow read access using something like allAuthenticatedUsers but winnowed to only apply to users who've authenticated using my application. I haven't found a way to do this, but it seems like it would be a pretty obvious solution to what must be a common problem. If it's not possible, I'm guessing it's because Google makes no distinction about how this user became authenticated, just that they are.

The alternative solution that comes to mind is creating IAM member accounts for users after they log in for the first time and restricting access to only those accounts, but I'd like to take the path of least resistance.

Upvotes: 0

Views: 94

Answers (2)

Pawel Czuczwara
Pawel Czuczwara

Reputation: 1520

You can check this example python signed url implementation. With the following steps:

  1. Construct canonical request with the path to resource to sign.
  2. Create a hex-encodec hash value of the above request. You can use haslib.
  3. Construct the string-to-sign, that includes following elments:
SIGNING_ALGORITHM: This should be GOOG4-RSA-SHA256.
CURRENT_DATETIME: The current date and time, in the ISO 8601 basic format YYYYMMDD'T'HHMMSS'Z'.
CREDENTIAL SCOPE: The credential scope of the request for signing the string-to-sign.
HASHED_CANONICAL_REQUEST: The hex-encoded, SHA-256 hash of the canonical request, which you created in the previous step.
  1. Sign the string-to-sign using an RSA signature with SHA-256, for example
  2. Construct the signed URL by using the following concatenation:
https://storage.googleapis.com/ + PATH_TO_RESOURCE + "?" + CANONICAL_QUERY_STRING + "&X-Goog-Signature=" + REQUEST_SIGNATURE

Please check this python sample of implementation.

Upvotes: 1

Andrei Tigau
Andrei Tigau

Reputation: 2048

In the case you are using App Engine you can use the App Engine App Identity service. In this way your users will be able to access the data using the App Engine service account credentials. More information about configuring this can be found here.

If this is not the case for you, creating IAM service account would be the single option I can see. You can do it programmatically using the Identity and Access Management (IAM) API. You can also create a Google group and add only invited users to the group. Then, you can give the group members the role : storage.objectViewer.

Upvotes: 1

Related Questions