Is there any way to host a public static website in GCP Cloud Storage and protect it using a username and password?

0
votes

GCP seems to allow you to delegate Cloud Storage authentication via IAM and that's great but you're only able to ever get a single file at a time using that method.

What I mean is, if I gave permissions to a user to have 'Storage Object Viewer' Role to a folder in a bucket, then a user would be able to browse to a single file (let's say an .html file) using https://storage.cloud.google.com/bucket-name/folder-name/filename and display that, but if that .html file contains .css or other files it needs the user to download then those all return 404 not found errors.

It seems that whatever token is obtained upon authentication is only valid for the retrieval of the single file that was requested before the token was created.

How does one host a static website, with some form of authentication in GCP Cloud Storage?

I did see a question similar to this asked over 5 years ago and thought GCP has changed considerably since then so that's why I'm re-asking.

Edit: Ok, let's assume I'm okay with public read-only access to bucket contents, and instead I'm going to focus on securing the GCP Cloud Functions which make the changes.

Now, I've enabled authentication on the GCP functions and used OAuth ID Token. The issue is now CORS. Any calls made to the GCP functions need a CORS access-control-allow-origin header, but that header does not get returned until AFTER the authentication.

Anybody know how to enable CORS on GCP Cloud Functions before any authentication takes place?

Thanks!

1
google-cloud-platformgoogle-cloud-storageweb-hosting
Have your users a Google account? I guess yes because you grant them on GCS. - guillaume blaquiere
Yes. They have gmail accounts. - Fadi
Just as an FYI.. I finally found the tidbit of documentation on GCP website highlighting that you should not apply IAM based permissions on Cloud Functions because the preflight OPTIONS request will get a 403 - forbidden. That's the way it works even though CORS specification states that OPTIONS requests do not need an Authorization header and responses must be allowed without one. In that same documentation, they state to use the Cloud Endpoints as a proxy. - Fadi

1 Answers

1
votes

You can host your static files on App Engine. The content is served for free!

In front of App Engine, you can activate IAP.

Finally, grant your user (or groups, or Google Workspace domains) the role IAP-Secured Web App User.