Signed URL for GCS PUT request on GAE with Python

I'm trying to create a signed URL for uploading files directly to Google Cloud Storage (GCS). I got it working using POST using this Github example , which makes use of policies. Following best practices, I'm refactoring to use PUT and getting the error:SignatureDoesNotMatch

<?xml version='1.0' encoding='UTF-8'?><Error><Code>SignatureDoesNotMatch</Code><Message>The request signature we calculated does not match the signature you provided. Check your Google secret key and signing method.</Message><StringToSign>PUT


123456789
/mybucket/mycat.jpg</StringToSign></Error>

According to the documentation on creating signed URLs using the program and GCP sample Python code , I'm doing the following:

1. build my signature string
2. sign
3. base64 encoding
4. url encodes the result (though the python example doesn't do this...

Since this program is running on a Google App Engine (GAE) application, I don't need to get a JSON key file for my service account user, but use App Identity Services to sign it. Here is the code in the Flask project:

google_access_id = app_identity.get_service_account_name()
expires = arrow.utcnow().replace(minutes=+10).replace(microseconds=0).timestamp
resource = '/mybucket/mycat.jpg'

args = self.get_parser.parse_args()
signature_string = 'PUT\n'
# take MD5 of file being uploaded and its content type, if provided
content_md5 = args.get('md5') or ''
content_type = args.get('contenttype') or ''
signature_string = ('PUT\n'
                    '{md5}\n'
                    '{content_type}\n'
                    '{expires}\n'
                    '{resource}\n').format(
                    md5=content_md5,
                    content_type=content_type,
                    expires=expires,
                    resource=resource)
log.debug('signature string:\n{}'.format(signature_string))
_, signature_bytes = app_identity.sign_blob(signature_string)
signature = base64.b64encode(signature_bytes)
# URL encode signature
signature = urllib.quote(signature)
media_url = 'https://storage.googleapis.com{}'.format(resource)
return dict(GoogleAccessId=google_access_id,
            Expires=expires,
            Signature=signature,
            bucket='mybucket',
            media_url='{}?GoogleAccessId={}&Expires={}&Signature={}'.format(media_url, google_access_id, expires, signature))

This log.debugstatement prints a signature file that exactly matches the signature in the GCS XML error response above. If it matches, why can't I upload?

Using gsutil, I can create a signed URL using the same GAE service account and it works fine in Postman. I see that gsutilthe URL encodes the signature, but neither seems to matter when creating my own signed URL: GCS gets my PUT request and complains that the signature doesn't match, even though the signature it shows matches mine . Logged debug messages. I've also tried the case with the trailing \n in the original signature string, or without the trailing \n.

edit:POSTI followed the Base64 example to encode the policy before the policy and encode it again after it's signed . I tried this approach when creating the PUT signature and it made no difference