Google Professional Cloud Developer Question 159
Single answerGoogle Cloud PlatformYou are developing an application that needs to grant time-limited access to specific objects stored in a Google Cloud Storage bucket. Which method should you use to ensure a user can temporarily access an object without requiring them to have a Google Cloud account?
- A
Create a signed URL for the object with an expiration time.
- B
Set an IAM policy on the bucket to allow the user access and manually remove it after the required time.
- C
Use a Service Account with an expiration timestamp to grant access to the bucket.
- D
Create a presigned URL using a custom script, allowing temporary access.
Show answer and explanation
Correct answer: A
Explanation
To grant time-limited access to objects in Cloud Storage, signed URLs are the recommended approach. They allow you to generate a time-bound URL that provides secure access to an object without requiring the user to have a Google Cloud account. This is both efficient and secure compared to alternatives like modifying IAM policies or creating custom scripts.
- A. Correct.
Correct. Signed URLs allow temporary access to specific objects in Cloud Storage without requiring the user to have a Google Cloud account, and you can specify an expiration time.
- B. Incorrect.
Incorrect. While you could manually set and remove IAM policies, this approach is inefficient, error-prone, and not ideal for time-limited access.
- C. Incorrect.
Incorrect. Service accounts do not have expiration timestamps, and this approach would unnecessarily complicate access management.
- D. Incorrect.
Incorrect. Google Cloud provides built-in functionality for signed URLs, making custom scripts redundant and less secure compared to using signed URLs.