in the last few days I have looked into Google Cloud Storage Buckets. I would like to know how to authenticate users when accessing data, preferably without the use of a backend.

Context: I have an app with the following requirements: Authenticated end users should be able to upload data to a (or their) bucket, with the default read access being scope to the user. At any point, the owner of the bucket should allow the bucket contents to be available to the public (publish bucket contents, read only).

End users are currently being authenticated with JWTs on the browser.

I have looked at the different ways of controlling access to Storage Buckets.

To my understanding:

• IAM is unsuitable as it is meant for Google Accounts and should be used within the company, not to authenticate end users (clients)
• ACLs are seemingly not recommended and are described as a legacy way meant for interoperability with S3
• Signed URLs are "ok" for uploads, but I would rather have an actually authenticated way of uploading.

What's totally unclear to me: what access control method can be used to authenticate my end users (pref. with JWTs) especially for reading data?

This seems like an issue everyone should face, but I can't seem to find good info? On a side note: I am aware that Firebase exists for this reason, I just want to know how to tackle this on GCP.

CodePudding user response：

There is no other solution than signed URL and a backend (I know that breaks your requirement) that check the authentication and generate that signedURL (on only the relevant/authorized files)

CodePudding user response：

When implementing this purely in GCP, you'll typically end up implementing your own auth solution for your clients, and then your own authorization model in your server-side code.

If you want to not implement this yourself, using Firebase for your Cloud Storage access would be the way to go. This implements client-side authentication and server-side security rules to control access.