Question: I am trying to give unauthenticated access (timebound) to list and download objects in a Google Storage bucket, and found Signed URLs can do the trick. But Signed URLs are good for a single object, and they have mentioned in the documentation <https://cloud.google.com/storage/docs/access-control/signed-urls#considerations>

> 
> When working with signed URLs, keep in mind the following:
> 
> 
> Signed URLs can only be used to access Cloud Storage resources through
> XML API endpoints.
> 
> 
> Signed URLs can generally be made for any XML API request; however,
> the Node.js Cloud Storage Client Libraries currently can only make
> signed URLs for individual objects. For example, it cannot be used to
> make signed URLs for listing objects in a bucket.
> 
> 
> 

Is there a way, in Node.js, Python, Java or any other client library or by manually creating signed urls where I can share the link with users so they can browse the bucket and download the required objects?

Thanks!

Answer: 
The short answer is not.

But I can explain why. In fact, you have to understand why the signed URL are great and useful.

I will take an example. You have a file of 1Tb and a requester want to download it. You have 2 solutions

* Download the file locally on the server, and then let the user downloading the file from the server
* Let the user directly download the file from the original location (cloud Storage).

---

In the first solution, the user is already authenticated on the server, and it's easy to let them downloaded securely the file. However, you need a huge temporary storage to store temporarily the file before the download by the user

In the second solution, no storage issue (and thus work also with serverless solution, Cloud Run, Cloud Function and App Engine) but you need to delegate the authorization to download the file: It's the purpose of the signed URL.

---

Now, go back to your use case: you want to delegate the file list feature. Why? because you have storage issues? Performance issues? Or by convenience?

Because this solution solves nothings, it has not been implemented. So you need to provide the list of files directly from your server, and then to delegate the download with a signed URL with the user has picked the files that they want.

---

**EDIT 1**

You need to have a Google Identity (User account or service account) to be authorized by IAM service to access to your bucket info.

But, there is a new feature that you can use if you have a non-google managed identity token. You an use [Workload Identity Pool](https://cloud.google.com/iam/docs/manage-workload-identity-pools-providers).

The idea is the following:

* Configure a provider to extract the correct data from the identity token that you have
* Configure a mapping between identity token claims and the service account to impersonate
* Impersonate the service account, generate an access token from it and then use this token to access to all the API granted on the service account.

I don't find the feature handful to use, but it works great and fit your requirements!
You cannot use signed URLs for this. You could give the user's account real permission on the bucket, but use a [conditional IAM policy](https://cloud.google.com/iam/docs/conditions-overview) to make it temporary, like in [this example](https://cloud.google.com/iam/docs/policies#conditional-bindings).