Set up a backend bucket

Cloud CDN leverages your choice of either the global external Application Load Balancer or the classic Application Load Balancer to provide routing, health checking, and anycast IP support. Because global external Application Load Balancers can have multiple backend instance types— Compute Engine VM instances, Google Kubernetes Engine Pods, Cloud Storage buckets, or external backends outside of Google Cloud—you can choose which backends (origins) to enable Cloud CDN for.

This setup guide shows you how to create an external Application Load Balancer with Cloud CDN enabled. The example uses the following resources:

• The default Virtual Private Cloud (VPC) network
• A default URL map
• A reserved external IP address
• A Cloud Storage bucket as the backend
• A single load balancer backend bucket that acts as a wrapper around the Cloud Storage bucket

A backend bucket supports the following:

• Cloud Storage buckets of any storage class, including multi-region buckets
• Cloud CDN policies for caching content at Google's global edge

To learn how Cloud CDN works, see the Cloud CDN overview.

By default, Cloud Storage uses the same cache that Cloud CDN uses. If you enable Cloud CDN on the backend bucket, you can use Cloud CDN controls on your content. Cloud CDN controls include, for example, cache modes, signed URLs, and invalidation. Cloud CDN also lets you cache large content (> 10 MB). If you don't enable Cloud CDN on your backend bucket, you can only use origin Cache-Control headers to control caching for smaller content, as set by the Cloud Storage metadata. When Cloud CDN is enabled, you can utilize both CDN-Cache-Control and standard Cache-Control origin headers to manage edge caching behavior.

Load balancer backends

An external Application Load Balancer uses a URL map to direct traffic from specified URLs to specified services. The following table summarizes the types of backends where you can host content and services.

Before you begin

• If you're using HTTPS for the frontend, create an SSL certificate, either self-managed or Google-managed. We recommend using a Google-managed certificate.
• If you're using the Google Cloud CLI, see Discover object storage with the gcloud tool to install it.

• Set a default project.

     gcloud config set project PROJECT_ID
   

    export GOOGLE_CLOUD_PROJECT=PROJECT_ID
   

Optional: Use BYOIP addresses

With bring your own IP (BYOIP), you can import your own public addresses to Google Cloud to use the addresses with Google Cloud resources. For example, if you import your own IPv4 addresses, you can assign one to the forwarding rule when you configure your load balancer. When you follow the instructions in this document to Create the external Application Load Balancer, provide the BYOIP address as the IP address.

For more information about using BYOIP, see Bring your own IP addresses.

Create a Cloud Storage bucket

If you have an existing Cloud Storage bucket that isn't already assigned to a load balancer, you can skip to the next step.

When you create a Cloud Storage bucket to use as the backend for an external Application Load Balancer with Cloud CDN, we recommend that you choose a multi-region bucket, which automatically replicates objects across multiple Google Cloud regions. This can improve the availability of your content and improve failure tolerance across your application.

gcloud storage buckets create gs://BUCKET_NAME --project=PROJECT_ID --default-storage-class=standard --location=us-east1 --uniform-bucket-level-access

# Cloud Storage bucket
resource "random_id" "bucket_prefix" {
  byte_length = 8
}

resource "google_storage_bucket" "default" {
  name                        = "${random_id.bucket_prefix.hex}-my-bucket"
  location                    = "us-east1"
  uniform_bucket_level_access = true
  storage_class               = "STANDARD"
  // delete bucket and contents on destroy.
  force_destroy = true
  // Assign specialty files
  website {
    main_page_suffix = "index.html"
    not_found_page   = "404.html"
  }
}

Copy a graphic file into your Cloud Storage bucket

To enable you to test the setup, copy a graphic file from a public Cloud Storage bucket to your own Cloud Storage bucket.

gcloud storage cp gs://gcp-external-http-lb-with-bucket/three-cats.jpg gs://BUCKET_NAME/never-fetch/

resource "null_resource" "upload_image" {
  provisioner "local-exec" {
    command = "gcloud storage cp gs://gcp-external-http-lb-with-bucket/three-cats.jpg gs://${google_storage_bucket.default.name}/never-fetch/ --recursive"
  }
}

# image object for testing, try to access http://<your_lb_ip_address>/test.jpg
resource "google_storage_bucket_object" "test_image" {
  name = "test-object"
  # Uncomment and add valid path to an object.
  #  source       = "/path/to/an/object"
  #  content_type = "image/jpeg"

  # Delete after uncommenting above source and content_type attributes
  content      = "Data as string to be uploaded"
  content_type = "text/plain"

  bucket = google_storage_bucket.default.name
}

In the Google Cloud console, click Refresh to verify that the graphic file is copied.

Make your Cloud Storage bucket accessible

You can make your Cloud Storage bucket publicly readable or restrict access to it.

Make your Cloud Storage bucket public

This example makes your Cloud Storage bucket publicly readable. This is the recommended approach for public content. With this setting, anyone on the internet can view and list your objects and their metadata, excluding ACLs. To reduce the risk of unintended data exposure, you should typically dedicate specific Cloud Storage buckets for public objects.

The following are alternatives to making an entire Cloud Storage bucket public:

• Use managed folders to make a portion of your bucket publicly readable.

• Make individual objects publicly readable. We don't recommend this approach, because it uses a legacy, Cloud Storage-specific permissioning system.

• Use signed URLs.

The following procedure grants all users access to view objects in your Cloud Storage bucket, making the bucket publicly readable.

gcloud storage buckets add-iam-policy-binding gs://BUCKET_NAME --member=allUsers --role=roles/storage.objectViewer

# make bucket public
resource "google_storage_bucket_iam_member" "default" {
  bucket = google_storage_bucket.default.name
  role   = "roles/storage.objectViewer"
  member = "allUsers"
}

Make your Cloud Storage bucket private

To enable access to your private buckets, grant the required IAM roles to the service account that performs cache fills.

  gcloud storage buckets add-iam-policy-binding gs://BUCKET_NAME \
      --member=serviceAccount:service-PROJECT_NUM@https-lb.iam.gserviceaccount.com \
      --role=roles/storage.objectViewer