Private GCS Bucket host static site

Google Cloud Compute Infrastructure
1

If I want to publish private bucket content over the internet, meaning I want to host my static website on a private bucket and add an HTTPS load balancer as the frontend, it’s not working.

In AWS, it’s easily possible to publish a private bucket through CloudFront.

3 Likes
2

Hello @abhishek-wings !

Take a look at this guide on how to configure a bucket to host a static website. Cloud Storage doesn’t support custom domains with HTTPS on its own, the mentioned guide utilizes Cloud Storage with an external Application Load Balancer to serve content from a custom domain over HTTPS.

Also, take a look at Static website examples and tips for GCP.

If the above option doesn’t work, you can contact Google Cloud Support to further look into your case. Let me know if it helped, thanks!

1 Like
3

Hi @abhishek-wings

For this achievement, you can use Private Origin Authentication feature.
Here are non exhaustifs steps you can follow:

  • Create your private GCS bucket and upload your static website’s contents
  • Create a service account with a GCS HMAC Key/Secret pair on GCS Settings
  • Create an External HTTP/HTTPS Load Balancer:
    • CDN enabled
    • FQDN based Internet NEG as backend service (targetting your GCS Bucket)
    • Update your Backend Service SecuritySettings configuration with HMAC Id and key

I hope this will helps you !

4 Likes
4

what if there is an Org policy in place that prevents public access to the bucket. what would be Google’s workaround that ?

Message:

IAM policy update failed

You cannot add the principals allUsers or allAuthenticatedUsers to the bucket’s policy because public access prevention is enforced. This constraint could be enforced at the bucket, project, folder, or organization level. Ask your org or project administrator about access options.

Thanks,

5 Likes
5

Hi @lai-123 ,

If I may, the answer to your use case is further down in my below answer.
I hope this will helps you

5 Likes
6

Hi,

Thank you for the Info. The documentation talks about Amazon S3 buckets, does this apply to GCS buckets ? Is there a Google documentation on that ?

Thanks,

5 Likes
7

Yes, it also concerns GCS.

“Private origin authentication gives Cloud CDN long-term resource access to private Amazon S3 buckets or other compatible object stores”

You will find the informations here : https://cloud.google.com/cdn/docs/configure-private-origin-authentication

Kindly

5 Likes
8

@ZKH Unfortunately you can not do this with google cloud bucket, as the lb backend already has an GCS category, which doesnt have this option to use private origin