Question

A media company stores premium video files in a private Cloud Storage bucket. They need to grant paying customers time-limited download access to specific objects directly from the browser. The customers do not have Google accounts, and no IAM identity should be created for them. The access grant must automatically expire after a short window. Which approach best meets these requirements?

Accepted Answer

Generate V4 signed URLs for the specific objects with a short expiration time and distribute them to authenticated paying customers.

Answer

Grant allUsers the Storage Object Viewer role on the bucket and rely on the application to hide the object paths.

Answer

Create an IAM policy binding with an IAM Condition based on request.time for each customer's Google identity.

Answer

Enable a Cloud CDN signed cookie policy on the bucket and share the cookie value with all customers.