Introduction

It summarizes how to publish Cloud Storage signed URLs (URLs that are valid for a certain period of time) in Python.

procedure

1. Creating a service account and key

Open IAM and Administration-> Service Accounts-> Service Accounts and select Create Service Account.

Then enter the service account name and select Create.

Then from Select Role, select Storage-> Storage Object Viewer and select Continue.

Then select Create Key, select JSON, and then select Create. Then the JSON file will be downloaded to your local PC, then select [Finish].

2. Creating a program

The Google Cloud documentation was only fragmented, so you'll have to combine the information yourself. First, check the python program on the following site.

V4 signing process with Cloud Storage tools (Open Language with English) https://cloud.google.com/storage/docs/access-control/signing-urls-with-helpers

`storage_generate_signed_url_v4.py`


from google.cloud import storage
import datetime


def generate_download_signed_url_v4(bucket_name, blob_name):
    """Generates a v4 signed URL for downloading a blob.

    Note that this method requires a service account key file. You can not use
    this if you are using Application Default Credentials from Google Compute
    Engine or from the Google Cloud SDK.
    """
    # bucket_name = 'your-bucket-name'
    # blob_name = 'your-object-name'

    storage_client = storage.Client()
    bucket = storage_client.bucket(bucket_name)
    blob = bucket.blob(blob_name)

    url = blob.generate_signed_url(
        version="v4",
        # This URL is valid for 15 minutes
        expiration=datetime.timedelta(minutes=15),
        # Allow GET requests using this URL.
        method="GET",
    )

    print("Generated GET signed URL:")
    print(url)
    print("You can use this URL with any user agent, for example:")
    print("curl '{}'".format(url))
    return url

When I try to run the above program (storage_generate_signed_url_v4.py), I get an error saying you need a private key. The program says "Note that this method requires a service account key file.", So you know that you need a service account key file. The service account key file is the JSON file created in the previous step, but there is no description on how to specify it.

So next, check the following python program.

Authentication using the service account key file https://cloud.google.com/bigquery/docs/authentication/service-account-file?hl=ja

from google.cloud import bigquery
from google.oauth2 import service_account

# TODO(developer): Set key_path to the path to the service account key
#                  file.
# key_path = "path/to/service_account.json"

credentials = service_account.Credentials.from_service_account_file(
    key_path,
    scopes=["https://www.googleapis.com/auth/cloud-platform"],
)

client = bigquery.Client(
    credentials=credentials,
    project=credentials.project_id,
)

The above program is an authentication method using a service account key file for BigQuery, but let's remake it for Cloud Storage. The changes are the following three points.

--Changed import target from bigquery to storage --Changed bigquery.Client to storage.Client --Uncomment key_path and specify the save location of the JSON file created earlier

`load_service_account.py`


from google.cloud import storage
from google.oauth2 import service_account

# TODO(developer): Set key_path to the path to the service account key
#                  file.
key_path = "path/to/service_account.json"

credentials = service_account.Credentials.from_service_account_file(
    key_path,
    scopes=["https://www.googleapis.com/auth/cloud-platform"],
)

client = storage.Client(
    credentials=credentials,
    project=credentials.project_id,
)

When I ran the above program (load_service_account.py) as a trial, no error occurred. Therefore, load_service_account.py and storage_generate_signed_url_v4.py are combined and some modifications are made. The corrections are as follows.

--Delete duplicate imports --Changed client = storage.Client () to storage_client = storage.Client () --Enter the bucket name and object name for which you want to get the signed URL in the last line and call the function --Change the minutes = 15 part if you want to change the expiration date of the signed URL

`storage_generate_signed_url_v4_auth.py`


import datetime
from google.cloud import storage
from google.oauth2 import service_account

# TODO(developer): Set key_path to the path to the service account key
#                  file.
key_path = "path/to/service_account.json"

credentials = service_account.Credentials.from_service_account_file(
    key_path,
    scopes=["https://www.googleapis.com/auth/cloud-platform"],
)

storage_client = storage.Client(
    credentials=credentials,
    project=credentials.project_id,
)

def generate_download_signed_url_v4(bucket_name, blob_name):
    """Generates a v4 signed URL for downloading a blob.

    Note that this method requires a service account key file. You can not use
    this if you are using Application Default Credentials from Google Compute
    Engine or from the Google Cloud SDK.
    """
    # bucket_name = 'your-bucket-name'
    # blob_name = 'your-object-name'

    storage_client = storage.Client()
    bucket = storage_client.bucket(bucket_name)
    blob = bucket.blob(blob_name)

    url = blob.generate_signed_url(
        version="v4",
        # This URL is valid for 15 minutes
        expiration=datetime.timedelta(minutes=15),
        # Allow GET requests using this URL.
        method="GET",
    )

    print("Generated GET signed URL:")
    print(url)
    print("You can use this URL with any user agent, for example:")
    print("curl '{}'".format(url))
    return url

def generate_download_signed_url_v4('test_bucket', 'test_blob')

3. Run

Run python.

python3 storage_generate_signed_url_v4_auth.py

You will get the following results. This is the signed URL.

Generated GET signed URL:
https://storage.googleapis.com/test_bucket/test_blob/Abbreviation
You can use this URL with any user agent, for example:
curl 'https://storage.googleapis.com/test_bucket/test_blob/Abbreviation

Reference URL

Signed URL https://cloud.google.com/storage/docs/access-control/signed-urls?hl=ja

V4 signing process with Cloud Storage tools (Language in English) https://cloud.google.com/storage/docs/access-control/signing-urls-with-helpers