Question

A media company serves premium video files from a Cloud Storage bucket that is configured as a backend bucket behind a global external Application Load Balancer with Cloud CDN enabled. The company wants to ensure that only paying subscribers can download individual video files, and each access grant must automatically expire after a short time window. They do not want to modify the client application to send custom authentication headers, and access should be enforced at the CDN edge before the origin is contacted. Which approach should they implement?

Accepted Answer

Configure Cloud CDN signed URLs by adding a signed URL key to the backend bucket and generating time-limited signed URLs for each authorized request.

Answer

Set the Cloud CDN cache mode to USE_ORIGIN_HEADERS and rely on the bucket's IAM policy to grant temporary access to subscribers.

Answer

Enable Identity-Aware Proxy (IAP) on the backend bucket so that users must authenticate with Google credentials before downloading files.

Answer

Create a Cloud Armor security policy that allows requests only from subscriber IP ranges and attach it to the backend bucket.