Google Professional Cloud Developer Question 158
Single answerGoogle Cloud PlatformYou are developing an application that temporarily shares access to a file stored in a Google Cloud Storage bucket with an external user. The file should only be accessible for 15 minutes, after which the access should expire automatically. Which approach should you use to achieve this?
- A
Generate a signed URL for the object with an expiration time of 15 minutes.
- B
Set the object's ACL to 'public' and remove public access after 15 minutes.
- C
Use the Google Cloud Storage REST API to grant access directly to the user's email address with a 15-minute expiration.
- D
Move the object to a temporary bucket with a lifecycle rule to delete the object after 15 minutes.
Show answer and explanation
Correct answer: A
Explanation
The best way to provide time-limited access to a Google Cloud Storage object is by generating a signed URL with an expiration time. Signed URLs allow external users to access the object without modifying the object's permissions or requiring the user to have a Google account. This approach is secure, flexible, and specifically designed for this use case.
- A. Correct.
This is the correct approach. Signed URLs allow you to grant time-limited access to specific objects in Google Cloud Storage without changing the object's permissions or ACLs. You can specify an expiration time, such as 15 minutes, for the URL.
- B. Incorrect.
This is not a best practice and does not provide time-limited access. Making an object public exposes it to everyone, and there is no built-in mechanism to automatically revoke public access after 15 minutes.
- C. Incorrect.
Google Cloud Storage ACLs do not support granting time-limited access directly to email addresses. Access expiration would need to be managed externally, which is not a recommended or practical approach in this scenario.
- D. Incorrect.
Moving the object to a temporary bucket with a lifecycle rule for deletion is not a solution for granting temporary access. Lifecycle rules manage object retention and deletion, not access control.