Google Cloud Storage公共Bucket无需单文件签名URL的匿名访问咨询

Great question—this is a common gotcha with the Google Cloud Storage console-specific URL format (https://storage.cloud.google.com/...)! That URL is tied to Google's authentication system, which is why it only works when you're logged into a Google account. Let's walk through your best alternatives to make your images accessible without signed URLs or requiring user login:

1. Make the Bucket/Objects Publicly Readable #

The most straightforward fix is to configure your bucket (or specific paths/objects) to allow public read access, then use the standard public-facing GCS URLs.

How to set it up: #

• Via Cloud Console: Navigate to your bucket, go to the "Permissions" tab, click "Add principal", enter allUsers as the principal, and assign the Storage Object Viewer role. You can narrow this down to specific folders by selecting the folder first instead of the whole bucket.
• Via gsutil command:
  • For an entire bucket:

    gsutil iam ch allUsers:objectViewer gs://[bucketname]
    

  • For a specific inner path (recursive access):

    gsutil iam ch allUsers:objectViewer gs://[bucketname]/[innerpath]/**
    

Public URL formats to use: #

Once public access is enabled, use either of these URLs (both work without login):

• https://storage.googleapis.com/[bucketname]/[innerpath]/[filename]
• https://[bucketname].storage.googleapis.com/[innerpath]/[filename]

⚠️ Important Note: Only use this for content that's safe to be accessible to anyone on the internet. Avoid storing sensitive data in publicly readable buckets.

2. Enable Static Website Hosting #

If you're using the bucket to host static assets (like images for a website), enabling static website hosting is a great option. It gives you cleaner URLs and integrates well with custom domains if you want.

How to set it up: #

1. In the Cloud Console, go to your bucket's "Settings" tab.
2. Find the "Static website hosting" section, select "Enable".
3. You can set a default page (e.g., index.html) if you're hosting a full site, but this isn't required for just images.
4. Ensure your objects are publicly readable (follow the steps from option 1).

Access URL: #

Use this format to access your images:

https://[bucketname].web.app/[innerpath]/[filename]

Or if you've linked Firebase, you can also use https://[bucketname].firebaseapp.com/[innerpath]/[filename]. You can also map a custom domain to this bucket for even more branded URLs.

3. Granular IAM Access (For Restricted Non-Public Access) #

If you don't want full public access but still want to avoid signed URLs, you can grant Storage Object Viewer access to specific users, Google Groups, or Cloud Identity accounts. This way, only those authorized users can access the objects (they'll still need to log into their Google account, but no signed URLs are required).

This is useful if you're sharing content with a specific team or group rather than the general public.

内容的提问来源于stack exchange，提问作者rendom