Google App Engine : Read from Google Cloud Storage

Question

I have a Flex/Java application on Google App Engine and all I want is to load large images from Google Cloud Storage using URLRequest in Flex. I'm sure this is simple but I can't get it to work. I will manually upload the images using the Google APIs Console so I don't need to write anything from the App. The images can not be public.

I'm not 100% sure how to access the file so this may be the problem. I tried these:

• "/gs/mybucket/myimage.jpg" : not found
• "/mybucket/myimage.jpg" : not found
• "http://commondatastorage.googleapis.com/mybucket/myimage.jpg" : denied

I added myappid@appspot.gserviceaccount.com in the Team tab in Google APIs Console with Can View permission and I used GSUtil to get and set ACLs on both mybucket and myimage.jpg to add a READ permission for myappid@appspot.gserviceaccount.com but that didn't help.

What am I doing wrong?

Answer 1

I'm not really sure how flex works or how it is trying to access the blobs.

However, if you want to respond to a http request with the content of a Google Storage object then you can use the serve method.

https://developers.google.com/appengine/docs/java/blobstore/overview#Serving_a_Blob

Answer 2

Are you authorizing the URLRequest call with an OAuth token? If not, then even though the request is initiated from an app engine app, it'll look to Google Cloud Storage like an unauthenticated, public read. I don't know if flex has a trace option but if there's a way to examine the request details, I'd check to see if you're setting up the proper authentication.

If it turns out to be too difficult to get flex to play nicely with OAuth, you could also use signed URLs (aka query string authenticated URLs). This gives you the ability to create a URL with a special signature that implicitly conveys your authorization but only people with that link can access the object. The object's ACL can be be set to disallow public access but your signed URLs will be able to read the object. You can also time limit a signed URLs, if you like. Here's the documentation on how to use this technique.