The simplest thing to do is to create signed URLs (same as what you would do on AWS S3 buckets).
The URL can be for the entire bucket or for specific objects within the bucket (provide fine grained access is enabled for the bucket).
anuj
I am passionate about getting cloud solutions right the first time. I help customers transition to the public cloud with the appropriate security controls and guardrails. GCP, AWS and Azure Security Specialist. <a href="https://calendly.com/anujvarma/google-cloud-architect-initial-consultation">Initial Consultation</a>