Google Professional Cloud Developer Question 160
Single answerGoogle Cloud PlatformYou are developing a web application that needs to provide users with time-limited access to specific files stored in a Google Cloud Storage bucket. The access should automatically expire after a predefined duration. Which method should you use to achieve this functionality?
- A
Generate a signed URL for the object with an expiration time.
- B
Use IAM roles to grant users temporary access and set an expiration time.
- C
Enable Object Lifecycle Management to automatically revoke access after a specific time.
- D
Use a Cloud Function to delete the object after the time-limited access expires.
Show answer and explanation
Correct answer: A
Explanation
To provide time-limited access to objects in Google Cloud Storage, generating a signed URL with an expiration time is the most appropriate solution. Signed URLs ensure secure, temporary access to a specific object without modifying bucket-level permissions or requiring complex automation.
- A. Correct.
Correct. Signed URLs allow you to grant time-limited access to specific objects in Google Cloud Storage by specifying an expiration time. This is the recommended method for this use case.
- B. Incorrect.
Incorrect. IAM roles do not support direct time-limited access to individual objects. IAM policies are more suited for long-term access control at a broader scope.
- C. Incorrect.
Incorrect. Object Lifecycle Management is designed to automate actions like deleting or moving objects based on conditions, not for granting or revoking temporary access.
- D. Incorrect.
Incorrect. While a Cloud Function could delete the object after the time-limited access expires, this approach is unnecessary and overly complex for granting temporary access.