Question

A media company stores large rendered video files in a Cloud Storage bucket. An external post-production partner needs to download a specific set of these files over the next 48 hours. The partner does not have Google accounts, and your security team prohibits making the bucket or objects public. You must grant time-limited, object-scoped access without provisioning IAM identities for the partner. What should you do?

Accepted Answer

Generate V4 signed URLs for the specific objects with a 48-hour expiration and share them with the partner.

Answer

Grant the allUsers principal the Storage Object Viewer role on the bucket and revoke it after 48 hours.

Answer

Add the partner's email addresses as Storage Object Viewer members via IAM Conditions with a time-based expiry.

Answer

Create a service account, download its key, and email the key to the partner to authenticate downloads.