Google Professional Cloud Developer Question 162
Single answerGoogle Cloud PlatformYou are developing an application that allows users to download files stored in a Google Cloud Storage bucket. For security purposes, you need to ensure that users are granted temporary, time-limited access to these files without exposing your application’s service account credentials. Which approach should you use to achieve this?
- A
Generate a Signed URL for the object and provide it to the user.
- B
Set a lifecycle policy on the bucket to automatically delete files after a set period of time.
- C
Grant the user the 'Storage Object Viewer' role on the bucket and revoke it after the required time.
- D
Use a Signed Policy Document to restrict access to the object for a limited time.
Show answer and explanation
Correct answer: A
Explanation
The best approach to provide time-limited access to specific objects in Google Cloud Storage is to use Signed URLs. Signed URLs generate a temporary link that allows access to an object for a specified duration, without the need for IAM permissions or exposing service account credentials. This is both secure and straightforward to implement.
- A. Correct.
This is correct. Signed URLs allow you to grant time-limited access to specific objects in a Cloud Storage bucket without requiring the user to have IAM permissions.
- B. Incorrect.
This is incorrect. A lifecycle policy is used to manage object storage by automatically deleting or archiving objects, but it does not provide time-limited access for users.
- C. Incorrect.
This is incorrect. Granting and revoking the 'Storage Object Viewer' role is not a scalable or secure way to provide temporary access, as it requires manual management and exposes unnecessary permissions.
- D. Incorrect.
This is incorrect. While Signed Policy Documents are used for uploading objects with restrictions, they are not intended for granting time-limited access to download objects.