Google Professional Cloud Network Engineer Question 523
Select 3Google Cloud PlatformYour company wants to provide temporary access to a specific object stored in a Google Cloud Storage bucket for an external vendor. The vendor should only be able to download the file for a limited time without requiring a Google account. You have decided to use signed URLs to achieve this. Which of the following steps are required to successfully configure and use signed URLs for this purpose?
- A
Generate a signed URL using a service account with the appropriate IAM role.
- B
Ensure that the bucket's permissions are set to 'Public Access' before generating the signed URL.
- C
Specify the expiration time when generating the signed URL.
- D
Upload the object to the bucket after generating the signed URL to ensure it is accessible.
- E
Provide the signed URL to the vendor so they can access the object.
Show answer and explanation
Correct answers: A, C, E
Explanation
Signed URLs provide a secure way to grant temporary access to objects in a Cloud Storage bucket without requiring the user to authenticate with a Google account. To generate a signed URL, you need a service account with appropriate permissions, and you must specify details such as the expiration time. Sharing the signed URL with the intended user is the final step in granting access. It is not necessary to make the bucket public, as the signed URL itself provides controlled access.
- A. Correct.
Correct: To generate a signed URL, you need a service account with the appropriate IAM role, such as 'roles/storage.objectViewer' or 'roles/storage.admin', to access the object and sign the URL.
- B. Incorrect.
Incorrect: The bucket's permissions do not need to be set to 'Public Access.' Signed URLs allow controlled, temporary access without making the bucket or object publicly accessible.
- C. Correct.
Correct: When generating a signed URL, you must specify an expiration time, as signed URLs are meant for temporary access only.
- D. Incorrect.
Incorrect: The object must already exist in the bucket before generating the signed URL. Uploading the object after generating the signed URL would fail, as the signed URL points to a specific object.
- E. Correct.
Correct: After generating the signed URL, you must share it with the external vendor so they can access the object.