Google Cloud通过Firebase调用file.getSignedUrl出现签名错误求助

Hey there! Let's break down why you're hitting that "Failure from metadata server" error when generating a signed URL—especially since it worked fine just a few days ago. Permissions are a likely culprit, but there are a few other angles to check too:

• First, make sure the service account your code is using has the roles/storage.objectViewer role (or a more specific role that includes storage.objects.get and storage.objects.getIamPolicy permissions) on the target bucket or object. Even if it worked before, permissions can get revoked accidentally via IAM updates, team changes, or automated policy adjustments.
• If you're relying on the default compute service account (for GCE/GKE instances), double-check that it hasn't had its permissions trimmed recently.

Wait a minute—your expiration value is '03-01 2500'. Most cloud storage APIs expect standardized date formats (like RFC 3339, e.g., '2024-12-31T23:59:59Z') or relative time strings (e.g., '7d' for 7 days). A year as far out as 2500 might be causing parsing issues with the metadata server. Test with a shorter, properly formatted expiration first to rule this out.

• If you're running this code on a GCP compute resource (VM, GKE pod), confirm the instance can reach the metadata server. Check that your VPC isn't restricted to block traffic to 169.254.169.254 (the metadata server's internal IP) and that no firewall rules are interfering.
• For local development, make sure you're authenticated with the correct service account key file. Use gcloud auth activate-service-account or set the GOOGLE_APPLICATION_CREDENTIALS environment variable—sometimes local auth credentials expire or get switched accidentally.

• If the target object or bucket had metadata updates recently (like enabling requester pays, adding retention policies, or setting object-level ACLs), that could break signed URL generation. For example, requester pays buckets require additional parameters in the signed URL to work correctly.
• Also, confirm the object still exists—if it was deleted or moved, the metadata server will throw errors when trying to fetch its details.

Strip your code down to the basics to isolate the issue. Here's a quick test snippet:

const { Storage } = require('@google-cloud/storage');
const storage = new Storage();

async function testSignedUrl() {
  const bucket = storage.bucket('your-test-bucket');
  const file = bucket.file('test-file.txt');
  try {
    const [url] = await file.getSignedUrl({
      action: 'read',
      expires: '2024-12-31T23:59:59Z'
    });
    console.log('Working signed URL:', url);
  } catch (err) {
    console.error('Error:', err);
  }
}

testSignedUrl();

If this works, the problem is likely in your original code's context (incorrect object paths, extra metadata parameters, etc.).

内容的提问来源于stack exchange，提问作者MQLN