Serve private images and videos from Cloud Storage to anonymous users while enforcing app-specific access logic. How should you configure access?

Generating a signed URL is the correct approach because it allows temporary, time-limited access to private Cloud Storage objects without requiring users to have Google accounts or specific IAM permissions. Your web application can authenticate users and then, based on your app-specific logic, generate and provide a signed URL for the requested private image or video. This ensures that only authenticated users can access the content, and only for the duration specified in the signed URL. Granting the Storage Object Viewer IAM role to allUsers would make the content publicly accessible, bypassing your application's authentication. Configuring Identity-Aware Proxy (IAP) is for securing access to applications and resources behind IAP, not directly for granting temporary access to Cloud Storage objects to anonymous users after app authentication. Using Cloud Armor with IP addresses is for network-level access control and DDoS protection, not for fine-grained object access based on application-level user authentication.