Cloud CDN is fronting images/spacetime.png in a private Cloud Storage bucket using USE_ORIGIN_HEADERS. Browser returns HTTP 403 and response header Cache-Control: private, max-age=0. How do you fix this?

The HTTP 403 error indicates a permissions issue. Cloud CDN needs permission to access the objects in the private Cloud Storage bucket to serve them. Granting the allUsers principal the Storage Legacy Object Reader role on the bucket allows Cloud CDN (and any public request) to read the objects. The Cache-Control: private, max-age=0 header suggests the object is not publicly accessible and not cached, reinforcing the permission problem. Enabling negative caching would cache 403 errors, not resolve the underlying access issue. Changing the cache mode to "Force cache all content" doesn't bypass permission checks; it just dictates caching behavior for accessible content. Increasing the backend service's default TTL affects how long content is cached, not whether it can be accessed in the first place.