Styjun

When is one 'Ready' to make Original Contributions to Mathematics?

Wouldn't putting an electronic key inside a small Faraday cage render it completely useless?

Cycles one side transparency

Changing text size or line height of QGIS attribute table?

What is the maximum amount of diamond in one Minecraft game?

Park the computer

How to deal with a Murder Hobo Paladin?

Is reasonable to assume that the 食 in 月食/日食 can be interpreted as the sun/moon being "eaten" during an eclipse?

Can you take the Dodge action while prone?

Why did Super-VGA offer the 5:4 1280*1024 resolution?

Tiny URL creator

Is this standard Japanese employment negotiations, or am I missing something?

How to delete multiple process id of a single process?

How do I check that users don't write down their passwords?

Did William Shakespeare hide things in his writings?

Is there an upper limit on the number of cards a character can declare to draw from the Deck of Many Things?

What is the highest level of accuracy in motion control a Victorian society could achieve?

Is it acceptable that I plot a time-series figure with years increasing from right to left?

My professor has told me he will be the corresponding author. Will it hurt my future career?

Taking advantage when HR forgets to communicate the rules

Shipped package arrived - didn't order, possible scam?

What can a novel do that film and TV cannot?

Was the 45.9°C temperature in France in June 2019 the highest ever recorded in France?

Why does this function pointer assignment work when assigned directly but not with the conditional operator?

How to signed url for Google cloud storage on Google App Engine Standard environment with Python3.7?

How to Create Google Cloud Storage Signed Urls on App Engine PythonHow to get credentials in Google AppEngine Python37What is “bytesToSign” in Google Cloud Security Products signBlob?Issue with Google Cloud Storage resumable upload URL from App EngineDefault credential for app engine project accessing google cloud storage?Get image from Google Cloud Storage in App EngineHow to upload images to Google Cloud Storage using Google App Engine?Is it posiblle to install pandas in Google App Engine Standard environment?Handling secrets in Google App Engine Standard EnvironmentGoogle Cloud Storage API cannot get Application Default Credentials on App Engine looking for Compute Engine errorPython 3 Django on App Engine Standard: App Fails to StartConnect to Google App Engine shared memcached from python3.7 runtimeGoogle Cloud Memorystore connect from “App Engine Java Standard Environment”

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

1

I can't find a way to have a working signed url on Google App Engine Standard environment with Python3.7.

I have look at the documentation here :
https://cloud.google.com/storage/docs/access-control/signing-urls-manually

Within a Google App Engine application, you can use the App Engine App Identity service to sign your string.

But the App Engine App Identity rely on google.appenginepackage, that is not availalble on python 3.7 env as explain here

Proprietary App Engine APIs are not available in Python 3. This section lists recommended replacements.

The overall goal is that your app should be fully portable and run in any standard Python environment. You write a standard Python app, not an App Engine Python app. As part of this shift, you are no longer required to use proprietary App Engine APIs and services for your app's core functionality. At this time, App Engine APIs are not available in the Python 3.7 runtime.

All the api on sdk rely on google.appengine and raise an exception on python 3.7 env : EnvironmentError('The App Engine APIs are not available.') raise here
that rely on proprietary api :

try:
 from google.appengine.api import app_identity
except ImportError:
 app_identity = None

I know I can use many solution like ServiceAccountCredentials.from_json_keyfile_dict(service_account_dict) but I have to upload a file with credentials directly on app engine and I can't do it since the project credential will be expose on git or ci.

I really want to rely on default credential from app engine like other Google Cloud api like storage.Client() for example that work out of box.

Any suggestion ?

python-3.x google-app-engine google-cloud-storage

share|improve this question

asked Mar 25 at 20:32

tchiot.ludotchiot.ludo

33533 silver badges1111 bronze badges

add a comment | 

1

I can't find a way to have a working signed url on Google App Engine Standard environment with Python3.7.

I have look at the documentation here :
https://cloud.google.com/storage/docs/access-control/signing-urls-manually

Within a Google App Engine application, you can use the App Engine App Identity service to sign your string.

But the App Engine App Identity rely on google.appenginepackage, that is not availalble on python 3.7 env as explain here

Proprietary App Engine APIs are not available in Python 3. This section lists recommended replacements.

The overall goal is that your app should be fully portable and run in any standard Python environment. You write a standard Python app, not an App Engine Python app. As part of this shift, you are no longer required to use proprietary App Engine APIs and services for your app's core functionality. At this time, App Engine APIs are not available in the Python 3.7 runtime.

All the api on sdk rely on google.appengine and raise an exception on python 3.7 env : EnvironmentError('The App Engine APIs are not available.') raise here
that rely on proprietary api :

try:
 from google.appengine.api import app_identity
except ImportError:
 app_identity = None

I know I can use many solution like ServiceAccountCredentials.from_json_keyfile_dict(service_account_dict) but I have to upload a file with credentials directly on app engine and I can't do it since the project credential will be expose on git or ci.

I really want to rely on default credential from app engine like other Google Cloud api like storage.Client() for example that work out of box.

Any suggestion ?

python-3.x google-app-engine google-cloud-storage

share|improve this question

asked Mar 25 at 20:32

tchiot.ludotchiot.ludo

33533 silver badges1111 bronze badges

add a comment | 

I can't find a way to have a working signed url on Google App Engine Standard environment with Python3.7.

I have look at the documentation here :
https://cloud.google.com/storage/docs/access-control/signing-urls-manually

Within a Google App Engine application, you can use the App Engine App Identity service to sign your string.

But the App Engine App Identity rely on google.appenginepackage, that is not availalble on python 3.7 env as explain here

Proprietary App Engine APIs are not available in Python 3. This section lists recommended replacements.

The overall goal is that your app should be fully portable and run in any standard Python environment. You write a standard Python app, not an App Engine Python app. As part of this shift, you are no longer required to use proprietary App Engine APIs and services for your app's core functionality. At this time, App Engine APIs are not available in the Python 3.7 runtime.

All the api on sdk rely on google.appengine and raise an exception on python 3.7 env : EnvironmentError('The App Engine APIs are not available.') raise here
that rely on proprietary api :

try:
 from google.appengine.api import app_identity
except ImportError:
 app_identity = None

I know I can use many solution like ServiceAccountCredentials.from_json_keyfile_dict(service_account_dict) but I have to upload a file with credentials directly on app engine and I can't do it since the project credential will be expose on git or ci.

I really want to rely on default credential from app engine like other Google Cloud api like storage.Client() for example that work out of box.

Any suggestion ?

python-3.x google-app-engine google-cloud-storage

share|improve this question

asked Mar 25 at 20:32

tchiot.ludotchiot.ludo

33533 silver badges1111 bronze badges

try:
 from google.appengine.api import app_identity
except ImportError:
 app_identity = None

share|improve this question

asked Mar 25 at 20:32

tchiot.ludotchiot.ludo

33533 silver badges1111 bronze badges

share|improve this question

asked Mar 25 at 20:32

tchiot.ludotchiot.ludo

33533 silver badges1111 bronze badges

asked Mar 25 at 20:32

tchiot.ludotchiot.ludo

33533 silver badges1111 bronze badges

asked Mar 25 at 20:32

tchiot.ludotchiot.ludo

33533 silver badges1111 bronze badges

1 Answer
1

active

oldest

votes

1

For Python interactions with Google Cloud use Python Client that is supported on App Engine standard Python 3 runtime.

To access Cloud Storage using google-cloud-storage from App Engine Standard:

1. Add dependency to the requirements.txt > google-cloud-storage==1.14.0


2. Use Storage Client library, authenticating with storage.Client() only.

Depending on what you need to achieve, I would also suggest trying different possible approaches:

1. Allow anonymous access for public data stored in the bucket.


2. For signed URL API call use Method: projects.serviceAccounts.signBlob. Documentation includes examples:
   
   
   • It is important to grant correct permissions to create tokens for Service account
     
   
   
   • You can also check how to use the API - explained on SO.
   
   
   • This example explains how to implement signing of the bucket URL using python
     
   
   

It is also possible to sign blobs with appengine api using:

google.appengine.api.app_identity.sign_blob()

share|improve this answer

edited Apr 25 at 15:31

answered Mar 26 at 12:05

Pawel CzuczwaraPawel Czuczwara

3951010 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  storage.Client() works well and i can access to GCS bucket but I need a SignedUrl. There is a Credential.sign_blob() on service account that works well but I can't find it with AppEngine, or I can't find the appengine private key that allow me to sign by myself ! Oauth key is not option, since the Credential don't have the sign_method ...
  
  – tchiot.ludo
  Mar 26 at 18:40
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  If you do not want to use google-cloud-storage library, that uses .signBlob, it gets more complicated, please see the solution provided here
  
  – Pawel Czuczwara
  Apr 25 at 15:12
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  This is another example how to sign url: github.com/GoogleCloudPlatform/storage-signedurls-python
  
  – Pawel Czuczwara
  Apr 25 at 15:22
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55345974%2fhow-to-signed-url-for-google-cloud-storage-on-google-app-engine-standard-environ%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

1

For Python interactions with Google Cloud use Python Client that is supported on App Engine standard Python 3 runtime.

To access Cloud Storage using google-cloud-storage from App Engine Standard:

1. Add dependency to the requirements.txt > google-cloud-storage==1.14.0


2. Use Storage Client library, authenticating with storage.Client() only.

Depending on what you need to achieve, I would also suggest trying different possible approaches:

1. Allow anonymous access for public data stored in the bucket.


2. For signed URL API call use Method: projects.serviceAccounts.signBlob. Documentation includes examples:
   
   
   • It is important to grant correct permissions to create tokens for Service account
     
   
   
   • You can also check how to use the API - explained on SO.
   
   
   • This example explains how to implement signing of the bucket URL using python
     
   
   

It is also possible to sign blobs with appengine api using:

google.appengine.api.app_identity.sign_blob()

share|improve this answer

edited Apr 25 at 15:31

answered Mar 26 at 12:05

Pawel CzuczwaraPawel Czuczwara

3951010 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  storage.Client() works well and i can access to GCS bucket but I need a SignedUrl. There is a Credential.sign_blob() on service account that works well but I can't find it with AppEngine, or I can't find the appengine private key that allow me to sign by myself ! Oauth key is not option, since the Credential don't have the sign_method ...
  
  – tchiot.ludo
  Mar 26 at 18:40
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  If you do not want to use google-cloud-storage library, that uses .signBlob, it gets more complicated, please see the solution provided here
  
  – Pawel Czuczwara
  Apr 25 at 15:12
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  This is another example how to sign url: github.com/GoogleCloudPlatform/storage-signedurls-python
  
  – Pawel Czuczwara
  Apr 25 at 15:22
  

  
  
  
  

add a comment | 

1

For Python interactions with Google Cloud use Python Client that is supported on App Engine standard Python 3 runtime.

To access Cloud Storage using google-cloud-storage from App Engine Standard:

1. Add dependency to the requirements.txt > google-cloud-storage==1.14.0


2. Use Storage Client library, authenticating with storage.Client() only.

Depending on what you need to achieve, I would also suggest trying different possible approaches:

1. Allow anonymous access for public data stored in the bucket.


2. For signed URL API call use Method: projects.serviceAccounts.signBlob. Documentation includes examples:
   
   
   • It is important to grant correct permissions to create tokens for Service account
     
   
   
   • You can also check how to use the API - explained on SO.
   
   
   • This example explains how to implement signing of the bucket URL using python
     
   
   

It is also possible to sign blobs with appengine api using:

google.appengine.api.app_identity.sign_blob()

share|improve this answer

edited Apr 25 at 15:31

answered Mar 26 at 12:05

Pawel CzuczwaraPawel Czuczwara

3951010 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  storage.Client() works well and i can access to GCS bucket but I need a SignedUrl. There is a Credential.sign_blob() on service account that works well but I can't find it with AppEngine, or I can't find the appengine private key that allow me to sign by myself ! Oauth key is not option, since the Credential don't have the sign_method ...
  
  – tchiot.ludo
  Mar 26 at 18:40
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  If you do not want to use google-cloud-storage library, that uses .signBlob, it gets more complicated, please see the solution provided here
  
  – Pawel Czuczwara
  Apr 25 at 15:12
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  This is another example how to sign url: github.com/GoogleCloudPlatform/storage-signedurls-python
  
  – Pawel Czuczwara
  Apr 25 at 15:22
  

  
  
  
  

add a comment | 

For Python interactions with Google Cloud use Python Client that is supported on App Engine standard Python 3 runtime.

To access Cloud Storage using google-cloud-storage from App Engine Standard:

1. Add dependency to the requirements.txt > google-cloud-storage==1.14.0


2. Use Storage Client library, authenticating with storage.Client() only.

Depending on what you need to achieve, I would also suggest trying different possible approaches:

1. Allow anonymous access for public data stored in the bucket.


2. For signed URL API call use Method: projects.serviceAccounts.signBlob. Documentation includes examples:
   
   
   • It is important to grant correct permissions to create tokens for Service account
     
   
   
   • You can also check how to use the API - explained on SO.
   
   
   • This example explains how to implement signing of the bucket URL using python
     
   
   

It is also possible to sign blobs with appengine api using:

google.appengine.api.app_identity.sign_blob()

share|improve this answer

edited Apr 25 at 15:31

answered Mar 26 at 12:05

Pawel CzuczwaraPawel Czuczwara

3951010 bronze badges

google.appengine.api.app_identity.sign_blob()

share|improve this answer

edited Apr 25 at 15:31

answered Mar 26 at 12:05

Pawel CzuczwaraPawel Czuczwara

3951010 bronze badges

answered Mar 26 at 12:05

Pawel CzuczwaraPawel Czuczwara

3951010 bronze badges

answered Mar 26 at 12:05

Pawel CzuczwaraPawel Czuczwara

3951010 bronze badges