How do I create signed URLs for Google Cloud Storage using a project-level service account?


Jeff Levine

For each Google Compute instance, there is a default service account as follows:

[email protected]

I can create an instance with the appropriate scope (ie https://www.googleapis.com/auth/devstorage.full_control ) and use that account to make API requests.

On this page: https://cloud.google.com/storage/docs/authentication#service_accounts it says :

Each project has a service account associated with it that can be used for authentication and enabling advanced features such as Signed URLs and uploading browsers using POST.

This means I can use that service account to create signed URLs. However, I don't know how to create a signed URL with that service account, as I can't seem to get the private key (.p12 file) associated with this account.

I can create a new separate service account from the developer console that has the option to download the .p12 file for signing, but the project-level service account doesn't appear under the "APIs and auth/credentials" section. I can see them under "Projects/Permissions" but can't do anything with them there.

Am I missing some other way to retrieve the private keys for these default accounts, or is there no way to sign the URL when using them?

Kamran

Any service account's p12 key can be used when authenticating through the main account or GCE service account or other service account with appropriate permissions on buckets and files.

In this case, just create a service account to download the p12 key, then sign your URL with:

$ gsutil signurl -d 10m privatekey.p12 gs:// bucket / foo

Although it is possible to use the following command to authenticate with other service accounts:

gcloud auth activate service account service account email --key-file key.p12

You can list and switch accounts with the following commands:

$ gcloud auth list
$ gcloud config set account

Related


Creating signed URLs for Google Cloud Storage using NodeJS

stukennedy I'm trying to create a signature for a privately stored file in Google Cloud Storage; so that I can distribute a time-limited link. Currently doing this and it makes a signature that's too short ... where am I going wrong? var crypto = require("cryp

Using Version Control with Signed URLs in Google Cloud Storage

Nick G. I'm having trouble signing a GET request to Google Cloud Storage (GCS) when specifying a "generation" (version number) on an object. Signing the URL without generating it works like a charm, and the GET request works fine. However, when I prepend the p

Creating signed URLs for Google Cloud Storage using NodeJS

stukennedy I'm trying to create a signature for a privately stored file in Google Cloud Storage; so that I can distribute a time-limited link. Currently doing this and it makes a signature that's too short ... where am I going wrong? var crypto = require("cryp

Using Version Control with Signed URLs in Google Cloud Storage

Nick G. I'm having trouble signing a GET request to Google Cloud Storage (GCS) when specifying a "generation" (version number) on an object. Signing the URL without generating it works like a charm, and the GET request works fine. However, when I prepend the p

Using Version Control with Signed URLs in Google Cloud Storage

Nick G. I'm having trouble signing a GET request to Google Cloud Storage (GCS) when specifying a "generation" (version number) on an object. Signing the URL without generating it works like a charm, and the GET request works fine. However, when I prepend the p

Create signed URL for Google Cloud Storage using NodeJS

Stuck Kennedy I'm trying to create a signature for a privately stored file in Google Cloud Storage; so I can distribute a limited time link. Currently doing this and the signature is too short...where am I going wrong? var crypto = require("crypto"); var ttl

Create signed URL for Google Cloud Storage using NodeJS

Stuck Kennedy I'm trying to create a signature for a privately stored file in Google Cloud Storage; so I can distribute a limited time link. Currently doing this and the signature is too short...where am I going wrong? var crypto = require("crypto"); var ttl