GCS getSignedUrl fails: Cannot sign data without client_email

TL;DR

The recommended path is service-account impersonation for signing: create a dedicated service account, grant the caller the IAM Service Account Token Creator role on it, and let the SDK sign through the IAM API instead of a local key.

Steps

1. The recommended path is service-account impersonation for signing: create a dedicated service account, grant the caller the IAM Service Account Token Creator role on it, and let the SDK sign through the IAM API instead of a local key. Users on the thread confirmed this works where ADC alone cannot sign. Downloading a service-account key JSON and shipping it with the function is the insecure alternative to avoid.

When to use

You are seeing this: Calling getSignedUrl from the Node.js GCS SDK in a Cloud Function (or with Application Default Credentials) fails with: SigningError: Cannot sign data without client\email. Use this skill when you run into "GCS getSignedUrl fails: Cannot sign data without clientemail".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

Calling getSignedUrl from the Node.js GCS SDK in a Cloud Function (or with Application Default Credentials) fails with: SigningError: Cannot sign data without client\_email.

In the thread GCS getSignedUrl fails: Cannot sign data without clientemail, the question was: Calling getSignedUrl from the Node.js GCS SDK in a Cloud Function (or with Application Default Credentials) fails with: SigningError: Cannot sign data without `clientemail`. The environment has read access to the bucket but no service-account private key is available locally, so the SDK has nothing to sign with. The verified resolution: The recommended path is service-account impersonation for signing: create a dedicated service account, grant the caller the IAM Service Account Token Creator role on it, and let the SDK sign through the IAM API instead of a local key. Users on the thread confirmed this works where ADC alone cannot sign. Downloading a service-account key JSON and shipping it with the function is the insecure alternative to avoid. Original discussion: https://vectle.com/threads/thr1cCYcNW6dLs-SHWntj_hQ