The next concept that we have is the sign URL, and we know that it is used for used to provide permissions
or access to the users for limited time and limited permissions.
Right.
Authentication Information.
Back end query is the query string itself allowing users without credentials to perform a specific options.
Once the user has signed URL, they will be able to access the object while creating the user or system.
Service account will need to have a permissions for which URL is giving permissions to.
So the principal should have permissions Who is giving the or creating the signed URL?
When you want to use sign URL, you want to provide access to the user or anyone who is using a particular
application.
Specific logic.
Most common use case is upload or download with a specific time.
You can.
You can generate the signed URL using this one sign URL minus D.
We are specifying the minutes right here and you can use different parameter here and I'm providing
my key if I'm using any service account.
Right, I can provide my key here which will authenticate this user a command.
Whether I'm able to create the signed URL for a particular object and once generated, successfully
generated, you will see this kind of sign URL.
So this is actual URL, you will get it and anyone has this particular URL access, they will be able
to access the cat.jpg file.
Next one is the sign policy document.
As I said, it is file level access control policy documents.
Specify what you can upload to a bucket in the post form.
It's a Json document.
It contains conditions like exact match or startswith or the content link range policy document allows
greater control over the size of a particular object who is uploading content type and other characteristics
of the object that is being uploaded.
And here in this particular example, we are saying the expiration time for that upload request.
A content type is equal to image and jpg if at all.
There is another different kind of image.
It will not be allowed the content length in the bytes.
So if you look at this one, right, this example, it's a one megabyte.
If I'm trying to upload two megabytes, then it will not be allowed the algorithm to for the encryption
data and then credentials for those.
This is one of the example that you can use it.
And when it is given or shown in the browser, right, this keys will be enforced in the HTML browser
itself.
The next one that we have is the conditions.
Am Conditions is like more granular enforcement of certain requesters attribute, I would say.
It defines an enforce conditions and attribute based on the access control, which means grant access
only when the conditions are met and only applicable to the bucket when the uniform bucket access policy
is turned on.
As an example, I can go here.
I'll go to the console now.
So I can go here and in the permissions we saw this particular permissions, right.
If I go and edit.
Add conditions here if I turn on the uniform.
I can say what I want to do it right.
I can say.
Restrict and then I can build the permissions like I can schedule, say, day of week.
Hour of week, expiring access.
I can say day of week, and I can define the days.
Right?
On Monday.
Choose the time zone.
I can define any time zone.
I can define additional conditions.
Also, I can say day of week and.
On.
Tuesday and I can choose any time zone.
Right.
And.
I can even read it.
The conditions, whatever I have put it, it will be like this in Json format.
Right?
And then I can.
Save.
So that condition is saved for me, right?
I can test changes and it will give you a report on whether that particular access is allowed or not.
Likewise, there are other parameters also which you can define in Iam conditions.
I will not go ahead and discuss all of that or show all of that, but some of why do we need it, right?
We want to give temporary access and we saw that you can give a time frame for production server access
only from corporate network.
You can actually define that and the agent type the condition specified in role binding for the Iam.
And you can say either it is resource property or request property and this is very generic when I'm
mentioning some of those are applicable to cloud storage bucket and some of those are not.
And this originally came from a VPC service control and we are going to see that in details for our
network security in some of the security and network engineering certification syllabus so you can restrict
data being exfiltrated from cloud storage, having temporary access or time frame access from a corporate
network or agent type.
And you can define the resource, attribute or request.
Attribute resource attributes are the compute engine.
You can say cloud storage bucket, right?
Examples are here or the request attribute.
You can say you can put forward different attributes there.
Some of those are applicable to cloud storage and some are not.
As an example, we just defined Monday and Tuesday, right?
I want to provide access to.
So it starts with zero and it can go up to six and there are different parameter you can configure it,
IP address and all that, but that is not applicable to cloud storage as such.
The next one that we have is from the security standpoint is Papp public access prevention.
Um, you, if at all, you are storing some private data within the cloud storage bucket.
And if you don't want to accidentally being exposed to the public network, this is what you can actually
do it.
And what you can do is bucket can be set restricted for public access using Papp Public access prevention
set stage two state to bucket and you can actually either so say enforced, which is like have that
configured or whatever it is configured at the organization level or the folder level public access
prevention policy, you can actually inherit that, right?
That is from the Pap.
Let's go ahead and try to put forward our bucket into Pap.
I can go here and in permissions tab, I can click on public access.
I can say confirm.
And you are about to revoke all public access to this one.
All users, including authenticated users, right?
I can say confirm.
And once I do that, I am actually restricting my bucket from any public access.
Right.
And you can go ahead and remove that particular public access.
That's it from.
Okay.
And this one is here, right?
I can go to go and switch it to uniform access policy so fine grain will be turned off.
I can click on that one and then there might be some implications which I can accept at project level
ACL to the bucket.
Iam policy.
I can just say uniform.
Now it is uniform.
You have 91 days left to revoke that uniform public access policy.
Right?
And you can go to fine grained access policy I can go to.
This particular bucket, I can just say access is uniform public.
Public access is not allowed.
And that's it, right?
If you have any questions on this one, let us know.
Otherwise, you can move to the next lecture.
That is our encryption, logging and monitoring.