Apartment floor plan download links are “expired” as soon as they are created

Rawaj Immobilier, a property developer in Meknes, lets its buyers download the floor plans of their apartment and their reservation contracts from the customer area. The files are in the private bucket gs://rawaj-documents-prod; the API api-rawaj, on the Compute Engine VM api-rawaj-01 (europe-west9-a), generates a signed URL valid for 15 minutes for each download, using the service account signature-docs@rawaj-prod-5528.iam.gserviceaccount.com.

Last night, the team tested the new feature for the end of the commercial offer at 18:00, directly on this server. This morning, buyers can no longer download any document: the browser shows an XML error page. The front-end developer sees a “CORS error” in the console; the back-end developer thinks an IAM role was removed.

No life-threatening emergency, but the sales department is getting calls. It is 09:14 (UTC time on your phone). You are connected over SSH to api-rawaj-01, with sudo, gcloud and gsutil.