Question

Your company stores private product manuals in a Cloud Storage bucket that has uniform bucket-level access enabled and no public access. A partner needs to download one specific PDF file directly, but the partner does not have a Google account and you must not grant any long-term IAM permissions. The download link should stop working after 2 hours. What should you do?

Accepted Answer

Generate a signed URL for the object with a 2-hour expiration and send it to the partner.

Answer

Add allUsers as a Storage Object Viewer on the bucket, then remove the binding after 2 hours.

Answer

Grant the partner's email address the Storage Object Viewer role on the object using an IAM condition.

Answer

Make the bucket public and rely on the object's lifecycle rule to delete the file after 2 hours.