1

By requirement, the google bucket I use for file storage should be private. But I need to make the files on the bucket accessible over google CDN.

Most of the documents I found describe the best practice involving signed URLs. But I need to make it work w/o signed URLs or cookies. Does anyone know how to achieve that? I've successfully configured the access over signed URLs, including all the permissions settings for bucket/CDN but that's not what I need.

GerKirill
  • 41
  • 6
  • 1
    Google Cloud CDNs support accessing Cloud Storage **private** buckets using a signing key. However, this is a form of Signed URLs. If you cannot use them then you have no solution using a CDN + Cloud Storage. Edit your question and clarify what you mean by Signed URLs and why you cannot use them. – John Hanley Oct 05 '22 at 00:36

3 Answers3

3

At this moment, Cloud CDN still requires tokenized access in order to access a private origin. There is a solution where you can deploy a proxy that will dynamically sign your request with an ephemerial token and access the private storage bucket.

https://github.com/GoogleCloudPlatform/cdn-auth-proxy

There is work underway for Cloud CDN that will allow you to dynamically generate an access token without having deploy a proxy, but a definitive time for the release has not been set.

The new Google Cloud Media CDN service allows you to access a private storage bucket via IAM permissions: https://cloud.google.com/media-cdn/docs/origins?hl=en#private-storage-buckets .

Dave
  • 434
  • 5
0

You can register service worker credentials in a json file on the webserver that is supposed to serve the files. Just make sure the worker has proper permissions to access the desired resources. In the gcloud SDK there is full support to make requests to protected resources via a service worker given the permissions are sufficient.

This way you can just map the requests dynamically to the web service and have the service take care of accessing and using protected credentials in the back.

abo
  • 86
  • 3
  • The thing is there is no webserver that is supposed to serve files. Google CDN is mapped directly to the bucket. So Google CDN is a "web server serving the files". – GerKirill Oct 04 '22 at 11:49
  • You have to proxy these requests somehow through your webserver if you are going to access the files without using a secure string. – abo Oct 04 '22 at 13:42
0

There is now a new feature available that makes accessing a private GCS bucket easier from the Cloud CDN service. Cloud CDN now supports v4 signing which will allow you to generate an ephemerial access token to GCS using S3 compatibility mode. A co-worker of mine wrote up a blog post that gives step-by-step directions to do this.

Dave
  • 434
  • 5