V4 signing process with Cloud Storage tools (original) (raw)

Skip to main content

• 說明文件

  • 指南
  • 參考資料
  • 範例
  • 資源

• 技術領域

• 跨產品工具

• 相關網站

• Console

• 聯絡我們

• 免費試用

• Discover

• 產品總覽

• Storage Intelligence 總覽

• 開始使用

• Cloud Storage 的 Terraform 支援

• 設定及管理 Storage Intelligence

• 建立值區

• 關於值區

• 建立 Bucket

• 值區位置

• 儲存空間級別

• 變更值區的預設儲存空間級別

• 管理值區

• 列出值區

• 移動及重新命名值區

• 刪除值區

• 以網域命名的值區驗證

• 上傳及下載物件

• 關於物件

• 上傳和下載總覽

• 管理物件

• 變更物件的的儲存空間級別

• List Objects

• 複製、重新命名及移動物件

• 刪除物件

• 物件轉碼

• 取得儲存資料的洞察資訊

• 使用 Gemini 分析儲存的資料

• 快取物件

• 關於快取

• 整理物件

• Cloud Storage 中的資料夾類型

• 控管資料生命週期

• 控管資料生命週期的選項

• 提出要求

• Cloud Storage 作業的一致性

• 批次要求

• 使用長期執行的作業

• 分頁顯示結果

• URI 萬用字元

• 安全資料

• 監控資料和用量

• 搭配使用 Cloud 稽核記錄和 Cloud Storage

• 使用記錄和儲存空間記錄

• 搭配使用 Cloud 稽核記錄和 Storage Insights

• 使用 gRPC 用戶端指標

• 使用用戶端追蹤

• 保護、備份和復原

• 總覽

• 虛刪除

  • 總覽
  • 設定及管理虛刪除政策
  • 使用虛刪除的物件
  • 使用虛刪除的值區
  • 設定預設的虛刪除保留期限
  • 使用虛刪建議
  • 停用虛刪除功能

• 使用 Cloud Storage FUSE 掛接值區

• 總覽

• 快速入門導覽課程

• 安裝 Cloud Storage FUSE

• 掛接值區

• 效能

• 使用指標

• 跨產品、雲端和平台工作

• 媒體工作負載的最佳做法

• 互通性

• 搭配大數據使用 Cloud Storage

• 整合 Google Cloud Platform 服務和工具

• 疑難排解

• 疑難排解

V4 signing process with Cloud Storage tools

Stay organized with collections Save and categorize content based on your preferences.

V4 signing is a process you can use to generate signatures for authentication in Cloud Storage XML API requests. This page describes how to use the Google Cloud CLI and Cloud Storage client libraries to create signed URLs, using service account credentials. Signed URLs give time-limited read or write access to a specific Cloud Storage resource. If you want to make your own program for creating signed URLs, readV4 signing with your own program instead.

Before you begin

Before performing the tasks in this page, complete the following steps:

1. Enable the Service Account Credentials API.
   Enable the API
2. Create a service account. If you already have a service account that you want to use to sign URLs, you can skip this step.
3. Give the service account sufficient permission such that it could perform the request that the signed URL will make. For example, if your signed URL will allow a user to read object data, the service account must itself have permission to read the object data.
   For the tasks described in this guide, ask your administrator to grant one of the following IAM roles to the service account:
   • Storage Object User (roles/storage.objectUser): Use this role to create signed URLs for both uploading and downloading objects. This role is also required if the signed URL could overwrite an existing object.
   • Storage Object Viewer (roles/storage.objectViewer): Use this role if you only want to create signed URLs for downloading objects.
   • Storage Object Creator (roles/storage.objectCreator): Use this role if you only want to create signed URLs for uploading objects and the uploaded object won't overwrite an existing object in the bucket.
     These predefined roles contain the permissions required to make signed URLs that download and upload objects. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

• storage.objects.get (not required if you only want to upload objects)
• storage.objects.create (not required if you only want to download objects)
• storage.objects.delete (not required if you don't need to overwrite objects when uploading)
  You might also be able to get these permissions with custom roles or other predefined roles. To see which roles are associated with which permissions, refer to IAM roles for Cloud Storage.

1. Have sufficient permission to sign blobs with the service account. Ask your administrator to grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator).
   • If you use user credentials for authentication, you should be the principal assigned this role, and this role should be granted on the service account that will be used to create the signed URLs.
   • If you use a service account attached to a compute instance for authentication, the service account must be the principal for this role in order to impersonate itself, and this role should be granted on the project that contains the service account.
     This predefined role contain the permission required to sign blobs with a service account. To see the exact permission that is required, expand the Required permissions section:

Required permissions

• iam.serviceAccounts.signBlob
  You might also be able to get this permission with custom roles or other predefined roles. To see which roles are associated with which permissions, refer to IAM roles for Cloud Storage.
  For instructions on granting roles on projects, seeManage access to projects.

Create a signed URL to download an object

To create a signed URL that can get an object from a bucket, complete the following steps:

Command line

1. Use the gcloud storage sign-url command. For example, the following command creates a signed URL that allows users to download an object for 10 minutes:
   gcloud storage sign-url gs://BUCKET_NAME/OBJECT_NAME --impersonate-service-account=SERVICE_ACCOUNT_EMAIL --duration=10m
   Where:
   • BUCKET_NAME is the name of the bucket where the object is located. For example, example-bucket.
   • OBJECT_NAME is the name of the object to download. For example, cat.jpeg.
   • SERVICE_ACCOUNT_EMAIL is the email address of a service account whose key will do the signing. For example,signed-url-account@my-project.iam.gserviceaccount.com.
     If successful, your response should look like:

expiration: '2023-07-14 23:19:35'
http_verb: GET
resource: gs://example-bucket/cat.jpeg
signed_url: https://storage.googleapis.com/example-bucket/cat.jpeg?
x-goog-signature=11ae9c61ca84dd0bec319f7d52a38029e5873caa2eeced0568
ef96076258cfc1a925a9683cc907d210036b61af9e06a13bf4a15b15fab3916669b
e2f4c9f66ea6be822bec5858af519a6da705415b5768721197be213103fa09b8a18
8a143be77a24351517ff208a2c62cfebb78040daf1f953907080bd98f9462739d11
1355b1d9bcf54705b862f37392c031fde0d52add1a4d3bbb98a22e8b7023f6a1623
2e0a2dd56e524d410624d28663e557fafaf4ba0a04290a1066f894713857b429258
d14f056066c7622baf114c124e645688e19b4df3c4a7925f580693c93fa9c1dae7f
dff0edff7259c72f3f0eadc5a9f9f556c83c9c8dc02ee3af8d20ab634bad&x-goog
-algorithm=GOOG4-RSA-SHA256&x-goog-credential=signed-url-account%40
my-project.iam.gserviceaccount.com%2F20230714%2Fus%2Fstorage%2Fgoog
4_request&x-goog-date=20230714T221935Z&x-goog-expires=600&x-goog-si
gnedheaders=host
This URL can be used by any person to access the associated resource (in this case cat.jpeg) for the designated length of time (in this case, 10 minutes).

Client libraries

C++

For more information, see theCloud Storage C++ API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

C#

For more information, see theCloud Storage C# API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Go

For more information, see theCloud Storage Go API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Java

For more information, see theCloud Storage Java API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Node.js

For more information, see theCloud Storage Node.js API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

PHP

For more information, see theCloud Storage PHP API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Python

For more information, see theCloud Storage Python API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Ruby

For more information, see theCloud Storage Ruby API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Create a signed URL to upload an object

To create a signed URL that can upload an object to a bucket, complete the following steps:

Command line

1. Use the gcloud storage sign-url command. For example, the following command creates a signed URL that allows users to upload a file for one hour:
   gcloud storage sign-url gs://BUCKET_NAME/OBJECT_NAME --impersonate-service-account=SERVICE_ACCOUNT_EMAIL --http-verb=PUT --duration=1h --headers=content-type=CONTENT_TYPE
   • BUCKET_NAME is the name of the bucket where the object is being uploaded. For example,example-bucket.
   • OBJECT_NAME is the name to assign to the uploaded object. For example, cat.png.
   • SERVICE_ACCOUNT_EMAIL is the email address of a service account whose key will do the signing. For example,signed-url-account@my-project.iam.gserviceaccount.com.
   • CONTENT_TYPE is the uploaded object's content type. For example, image/png.
     If successful, your response should look like:

expiration: '2023-07-14 23:35:47'
http_verb: PUT
resource: gs://example-bucket/cat.png
signed_url: https://storage.googleapis.com/example-bucket/cat.png?
x-goog-signature=2f670a686102963e0574f3c1a3b4d29ee4aa406c1528d42d2
30195d17fef73834b254314de7d7990afd48538a84b66f20010e7ecd90a900490e
6119b7e56a912f71c8d64285c40e86f31b8fec51cf8c7a61ded81de3cedac9c1ca
b92474b7371740fdac20b2d8d092b15396f79443bbde954a4174ed11aef6c2cf5f
a4d72a84ff60fd6003ed0a505b0e40b6207ddbaec2a15778f715c3ec7537a1b14f
b6661b2abaa5736f1670a412ca7e2555c830591f0595c01ff95af7f2206abe2e27
41948c16d4bd4c7cbb25f41277ece59236c06e00ca6c63ae2eb3efc22c216bb24c
e1b8b3801d07fd3a7ed3f2df3db6e59c6fc3cc76a002335dd936efd0237cf584e3
6&x-goog-algorithm=GOOG4-RSA-SHA256&x-goog-credential=signed-url-a
ccount%40my-project.iam.gserviceaccount.com%2F20230714%2Fus%2Fstor
age%2Fgoog4_request&x-goog-date=20230714T223547Z&x-goog-expires=36
00&x-goog-signedheaders=content-type%3Bhost
This URL can be used by any person to upload a resource (in this case cat.png) to the specified Cloud Storage bucket for the designated length of time (in this case, 1 hour).

Client libraries

C++

For more information, see theCloud Storage C++ API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

C#

For more information, see theCloud Storage C# API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Go

For more information, see theCloud Storage Go API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Java

For more information, see theCloud Storage Java API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Node.js

For more information, see theCloud Storage Node.js API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

PHP

For more information, see theCloud Storage PHP API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Python

For more information, see theCloud Storage Python API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

Ruby

For more information, see theCloud Storage Ruby API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, seeSet up authentication for client libraries.

What's next

• Learn how to sign URLs with your own program.
• Learn more about signed URLs.
• Learn about uploading an object with the XML API.
• Learn about uploading objects.

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-06-10 UTC.