Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menunjukkan cara menggunakan metode Google Cloud signBlob
untuk membuat tanda tangan dari dokumen kebijakan atau string-to-sign. Tanda tangan
digunakan sebagai kredensial dalam permintaan tertentu, seperti URL yang ditandatangani. Panduan
ini menggunakan kunci RSA untuk membuat tanda tangan.
Anda harus memiliki izin iam.serviceAccounts.signBlob untuk akun layanan yang Anda gunakan dalam panduan ini. Izin iam.serviceAccounts.signBlob
disertakan dalam peran roles/iam.serviceAccountTokenCreator.
Akun layanan yang Anda gunakan dalam panduan ini harus memiliki izin untuk melakukan permintaan yang dienkode dalam tanda tangan. Misalnya, jika tanda tangan akan digunakan untuk membaca data objek dari bucket, akun layanan harus memiliki izin untuk membaca data objek.
JSON_FILE_NAME adalah nama file yang Anda buat di Langkah 2.
SERVICE_ACCOUNT_EMAIL adalah alamat email
akun layanan yang ingin Anda gunakan untuk membuat tanda tangan. Contoh, service-7550275089395@my-pet-project..
Jika berhasil, message digest akan ditampilkan di kolom signedBlob dalam
respons, yang dienkode base64.
Untuk menyelesaikan tanda tangan, pastikan ringkasan pesan didekode base64, lalu dienkode hex.
Langkah berikutnya
Lihat halaman referensi untuk menandatangani blob dengan Google Cloud CLI.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-03 UTC."],[],[],null,["# Create signatures\n\nThis page shows you how to use the [Google Cloud `signBlob` method](/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signBlob)\nto create a [signature](/storage/docs/authentication/signatures) from a string-to-sign or policy document. Signatures\nare used as credentials in certains requests, such as [signed URLs](/storage/docs/access-control/signed-urls). This\nguide uses RSA keys for creating signatures.\n| **Important:** The [Google-managed service account keys](/iam/docs/service-account-creds#google-managed-keys) used by the `signBlob` method are rotated regularly. If you set an expiration time for a signature that is greater than 12 hours and generate the signature using the `signBlob` method, the signature is usable for at least 12 hours, but might stop working prior to the expiration time due to key rotation. Signatures generated using the `signBlob` method are best used for short-lived access to resources.\n\nBefore you begin\n----------------\n\n1.\n\n\n Enable the Service Account Credentials API.\n\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=iamcredentials.googleapis.com&redirect=https://console.cloud.google.com)\n\n \u003cbr /\u003e\n\n2. You must have the `iam.serviceAccounts.signBlob` permission for the service\n account that you use in this guide. The `iam.serviceAccounts.signBlob`\n permission is included in the `roles/iam.serviceAccountTokenCreator` role.\n\n3. The service account that you use in this guide must have permission to\n perform the request encoded within the signature. For example, if the\n signature will be used to read object data from a bucket, the service\n account must have permission to read the object data.\n\nCreate a signature\n------------------\n\n1. Have gcloud CLI [installed and initialized](/sdk/docs/install), which lets\n you generate an access token for the `Authorization` header.\n\n\n2. Create a JSON file that contains the following information:\n\n\n ```json\n {\n \"payload\": \"\u003cvar translate=\"no\"\u003eREQUEST_INFORMATION\u003c/var\u003e\"\n }\n ```\n\n\n Where:\n\n\n - \u003cvar translate=\"no\"\u003eREQUEST_INFORMATION\u003c/var\u003e is a [string-to-sign](/storage/docs/authentication/signatures#string-to-sign) or a [policy document](/storage/docs/authentication/signatures#policy-document). For both, content must be base64-encoded.\n3. Use [`cURL`](http://curl.haxx.se/) to call the IAM API with a\n [`signBlob`](/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signBlob) request:\n\n ```\n curl -X POST --data-binary @JSON_FILE_NAME \\\n -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n \"https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/SERVICE_ACCOUNT_EMAIL:signBlob\"\n ```\n\n Where:\n - \u003cvar translate=\"no\"\u003eJSON_FILE_NAME\u003c/var\u003e is the name of the file you created\n in Step 2.\n\n - \u003cvar translate=\"no\"\u003eSERVICE_ACCOUNT_EMAIL\u003c/var\u003e is the email address of the\n service account you want to use to create the signature. For example,\n `service-7550275089395@my-pet-project.iam.gserviceaccount.com`.\n\n If successful, a *message digest* is returned in the `signedBlob` field in\n the response, which is base64 encoded.\n4. To complete the signature, ensure the message digest is base64 decoded, and\n then hex-encode the message digest.\n\nWhat's next\n-----------\n\n- See the reference page for signing blobs with the [Google Cloud CLI](/sdk/gcloud/reference/iam/service-accounts/sign-blob).\n- [Create a signed URL manually](/storage/docs/access-control/signing-urls-manually), using the signature you created.\n- [Create a signed URL with Google Cloud tools](/storage/docs/access-control/signing-urls-with-helpers).\n- Learn more about [signatures](/storage/docs/authentication/signatures)."]]
