Search code examples
google-workflows

Create GCS V4 signed url via google cloud workflows

Before I conclude that I can't do this with google cloud workflows alone, I just wanted to check with the community that I'm not missing anything...

I have a google cloud workflows program which exports data from BigQuery to GCS and then sends an email to a user with a URL in the body of the email. I want this URL to be signed.

The gcloud CLI and language-specific libraries all come with nice helpers to do this but I can't access any of this direct from google cloud workflows. I considered implementing my own sub-workflow which would perform the logic described in the signing URLS manually documentation but I don't think I can do this from Workflows alone (I could easily create some cloud func which I call [and in that case, I could just use the helper from the python SDK for example] but I'm trying to avoid that). The following functionality from the python example constitute blockers; logic that I believe I can't do from google cloud workflows alone - unless anyone knows of public web services that I can call to get around this?

  • canonical_request_hash = hashlib.sha256(canonical_request.encode()).hexdigest()
  • signature = binascii.hexlify(google_credentials.signer.sign(string_to_sign)).decode()

Everything else I could just about do in a fairly long and drawn out sub-workflow... but it would be possible.

Solution

  • Cloud Workflows do not natively support hashing & RSA signing libraries within its Standard library which is a core requirement of GCS URL signing algorithm.

    As also advised in public docs, Cloud workflows / sub-workflows should be primarily used as an orchestration flow to invoke services, parse responses, and construct inputs for other connected services. Services (like Cloud Function / Run etc.) should be created to perform any work that is too complex for Workflows or for operations that are not natively supported by Workflows expressions and its standard library.

    Solution for above use case is to either:

    a) Create a service (~ triggered from Cloud Workflow) like Cloud Function to generate signed GCS URLs. OR b) Generate the GCS Signed URL as an independent task outside & after execution of the core workflow operation as shown in this sample.