The last major access control mechanism in Cloud Storage is signed URLs. Signed URLs are generated URLs that can be used to make authorized requests to the Google Cloud Storage API without the user of the URL needing to be authorized to make those calls. Essentially, a user or service specifies a target object, one or more actions to be taken, an expiration, and a signature to prove the URL was generated by an authorized user. Because the URL is only valid for a given resource/action and has built-in expiration, it can be given to non-authorized users without fear of other data becoming compromised.
Signed URLs are a great way to build more advanced and automated control flows and they have many applications in systems that interact ...
