Download a CSEK-encrypted object

  namespace 
  
 gcs 
  
 = 
  
 :: 
 google 
 :: 
 cloud 
 :: 
 storage 
 ; 
 []( 
 gcs 
 :: 
 Client 
  
 client 
 , 
  
 std 
 :: 
 string 
  
 const 
&  
 bucket_name 
 , 
  
 std 
 :: 
 string 
  
 const 
&  
 object_name 
 , 
  
 std 
 :: 
 string 
  
 const 
&  
 base64_aes256_key 
 ) 
  
 { 
  
 gcs 
 :: 
 ObjectReadStream 
  
 stream 
  
 = 
  
 client 
 . 
 ReadObject 
 ( 
 bucket_name 
 , 
  
 object_name 
 , 
  
 gcs 
 :: 
 EncryptionKey 
 :: 
 FromBase64Key 
 ( 
 base64_aes256_key 
 )); 
  
 std 
 :: 
 string 
  
 data 
 ( 
 std 
 :: 
 istreambuf_iterator<char> 
 { 
 stream 
 }, 
  
 {}); 
  
 if 
  
 ( 
 stream 
 . 
 bad 
 ()) 
  
 throw 
  
 google 
 :: 
 cloud 
 :: 
 Status 
 ( 
 stream 
 . 
 status 
 ()); 
  
 std 
 :: 
 cout 
 << 
 "The object contents are: " 
 << 
 data 
 << 
 " 
 \n 
 " 
 ; 
 } 
 

  using 
  
  Google.Cloud.Storage.V1 
 
 ; 
 using 
  
 System 
 ; 
 using 
  
 System.IO 
 ; 
 public 
  
 class 
  
 DownloadEncryptedFileSample 
 { 
  
 public 
  
 void 
  
 DownloadEncryptedFile 
 ( 
  
 string 
  
 key 
  
 = 
  
 "3eFsTXPvqi3BpT2ipFCGirslh1Jgc6ikjoAu2oQ5JcI=" 
 , 
  
 string 
  
 bucketName 
  
 = 
  
 "your-unique-bucket-name" 
 , 
  
 string 
  
 objectName 
  
 = 
  
 "my-file-name" 
 , 
  
 string 
  
 localPath 
  
 = 
  
 "my-local-path/my-file-name" 
 ) 
  
 { 
  
 var 
  
 storage 
  
 = 
  
  StorageClient 
 
 . 
  Create 
 
 (); 
  
 using 
  
 var 
  
 outputFile 
  
 = 
  
 File 
 . 
 OpenWrite 
 ( 
 localPath 
 ); 
  
 storage 
 . 
 DownloadObject 
 ( 
 bucketName 
 , 
  
 objectName 
 , 
  
 outputFile 
 , 
  
 new 
  
  DownloadObjectOptions 
 
  
 { 
  
 EncryptionKey 
  
 = 
  
  EncryptionKey 
 
 . 
  Create 
 
 ( 
 Convert 
 . 
 FromBase64String 
 ( 
 key 
 )) 
  
 }); 
  
 Console 
 . 
 WriteLine 
 ( 
 $"Downloaded {objectName} to {localPath}." 
 ); 
  
 } 
 } 
 

  import 
  
 ( 
  
 "context" 
  
 "fmt" 
  
 "io" 
  
 "time" 
  
 "cloud.google.com/go/storage" 
 ) 
 // downloadEncryptedFile reads an encrypted object. 
 func 
  
 downloadEncryptedFile 
 ( 
 w 
  
 io 
 . 
  Writer 
 
 , 
  
 bucket 
 , 
  
 object 
  
 string 
 , 
  
 secretKey 
  
 [] 
 byte 
 ) 
  
 ([] 
 byte 
 , 
  
 error 
 ) 
  
 { 
  
 // bucket := "bucket-name" 
  
 // object := "object-name" 
  
 // key := []byte("secret-encryption-key") 
  
 ctx 
  
 := 
  
 context 
 . 
 Background 
 () 
  
 client 
 , 
  
 err 
  
 := 
  
 storage 
 . 
 NewClient 
 ( 
 ctx 
 ) 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 nil 
 , 
  
 fmt 
 . 
 Errorf 
 ( 
 "storage.NewClient: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 defer 
  
 client 
 . 
 Close 
 () 
  
 obj 
  
 := 
  
 client 
 . 
  Bucket 
 
 ( 
 bucket 
 ). 
  Object 
 
 ( 
 object 
 ) 
  
 ctx 
 , 
  
 cancel 
  
 := 
  
 context 
 . 
 WithTimeout 
 ( 
 ctx 
 , 
  
 time 
 . 
 Second 
 * 
 50 
 ) 
  
 defer 
  
 cancel 
 () 
  
 rc 
 , 
  
 err 
  
 := 
  
 obj 
 . 
  Key 
 
 ( 
 secretKey 
 ). 
  NewReader 
 
 ( 
 ctx 
 ) 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 nil 
 , 
  
 fmt 
 . 
 Errorf 
 ( 
 "Object(%q).Key(%q).NewReader: %w" 
 , 
  
 object 
 , 
  
 secretKey 
 , 
  
 err 
 ) 
  
 } 
  
 defer 
  
 rc 
 . 
 Close 
 () 
  
 data 
 , 
  
 err 
  
 := 
  
 io 
 . 
 ReadAll 
 ( 
 rc 
 ) 
  
 if 
  
 err 
  
 != 
  
 nil 
  
 { 
  
 return 
  
 nil 
 , 
  
 fmt 
 . 
 Errorf 
 ( 
 "io.ReadAll: %w" 
 , 
  
 err 
 ) 
  
 } 
  
 fmt 
 . 
 Fprintf 
 ( 
 w 
 , 
  
 "File %v downloaded with encryption key.\n" 
 , 
  
 object 
 ) 
  
 return 
  
 data 
 , 
  
 nil 
 } 
 

  import 
  
 com.google.cloud.storage. Blob 
 
 ; 
 import 
  
 com.google.cloud.storage. Storage 
 
 ; 
 import 
  
 com.google.cloud.storage. StorageOptions 
 
 ; 
 import 
  
 java.io.IOException 
 ; 
 import 
  
 java.nio.file.Path 
 ; 
 public 
  
 class 
 DownloadEncryptedObject 
  
 { 
  
 public 
  
 static 
  
 void 
  
 downloadEncryptedObject 
 ( 
  
 String 
  
 projectId 
 , 
  
 String 
  
 bucketName 
 , 
  
 String 
  
 objectName 
 , 
  
 Path 
  
 destFilePath 
 , 
  
 String 
  
 decryptionKey 
 ) 
  
 throws 
  
 IOException 
  
 { 
  
 // The ID of your GCP project 
  
 // String projectId = "your-project-id"; 
  
 // The ID of your GCS bucket 
  
 // String bucketName = "your-unique-bucket-name"; 
  
 // The ID of your GCS object 
  
 // String objectName = "your-object-name"; 
  
 // The path to which the file should be downloaded 
  
 // Path destFilePath = Paths.get("/local/path/to/file.txt"); 
  
 // The Base64 encoded decryption key, which should be the same key originally used to encrypt 
  
 // the object 
  
 // String decryptionKey = "TIbv/fjexq+VmtXzAlc63J4z5kFmWJ6NdAPQulQBT7g="; 
  
  Storage 
 
  
 storage 
  
 = 
  
  StorageOptions 
 
 . 
 newBuilder 
 (). 
 setProjectId 
 ( 
 projectId 
 ). 
 build 
 (). 
  getService 
 
 (); 
  
  Blob 
 
  
 blob 
  
 = 
  
 storage 
 . 
  get 
 
 ( 
 bucketName 
 , 
  
 objectName 
 ); 
  
 blob 
 . 
  downloadTo 
 
 ( 
 destFilePath 
 , 
  
 Blob 
 . 
 BlobSourceOption 
 . 
 decryptionKey 
 ( 
 decryptionKey 
 )); 
  
 System 
 . 
 out 
 . 
 println 
 ( 
  
 "Downloaded object " 
  
 + 
  
 objectName 
  
 + 
  
 " from bucket name " 
  
 + 
  
 bucketName 
  
 + 
  
 " to " 
  
 + 
  
 destFilePath 
  
 + 
  
 " using customer-supplied encryption key" 
 ); 
  
 } 
 } 
 

  /** 
 * TODO(developer): Uncomment the following lines before running the sample. 
 */ 
 // The ID of your GCS bucket 
 // const bucketName = 'your-unique-bucket-name'; 
 // The ID of your GCS file 
 // const srcFileName = 'your-file-name'; 
 // The path to which the file should be downloaded 
 // const destFileName = '/local/path/to/file.txt'; 
 // The Base64 encoded decryption key, which should be the same key originally 
 // used to encrypt the file 
 // const encryptionKey = 'TIbv/fjexq+VmtXzAlc63J4z5kFmWJ6NdAPQulQBT7g='; 
 // Imports the Google Cloud client library 
 const 
  
 { 
 Storage 
 } 
  
 = 
  
 require 
 ( 
 ' @google-cloud/storage 
' 
 ); 
 // Creates a client 
 const 
  
 storage 
  
 = 
  
 new 
  
 Storage 
 (); 
 async 
  
 function 
  
 downloadEncryptedFile 
 () 
  
 { 
  
 const 
  
 options 
  
 = 
  
 { 
  
 destination 
 : 
  
 destFileName 
 , 
  
 }; 
  
 // Decrypts and downloads the file. This can only be done with the key used 
  
 // to encrypt and upload the file. 
  
 await 
  
 storage 
  
 . 
 bucket 
 ( 
 bucketName 
 ) 
  
 . 
 file 
 ( 
 srcFileName 
 ) 
  
 . 
  setEncryptionKey 
 
 ( 
 Buffer 
 . 
 from 
 ( 
 encryptionKey 
 , 
  
 ' base64 
' 
 )) 
  
 . 
  download 
 
 ( 
 options 
 ); 
  
 console 
 . 
 log 
 ( 
 `File 
 ${ 
 srcFileName 
 } 
 downloaded to 
 ${ 
 destFileName 
 } 
 ` 
 ); 
 } 
 downloadEncryptedFile 
 (). 
 catch 
 ( 
 console 
 . 
 error 
 ); 
 

  use Google\Cloud\Storage\StorageClient; 
 /** 
 * Download an encrypted file 
 * 
 * @param string $bucketName The name of your Cloud Storage bucket. 
 *        (e.g. 'my-bucket') 
 * @param string $objectName The name of your Cloud Storage object. 
 *        (e.g. 'my-object') 
 * @param string $destination The local destination to save the encrypted file. 
 *        (e.g. '/path/to/your/file') 
 * @param string $base64EncryptionKey The base64 encoded encryption key. Should 
 *        (e.g. 'TIbv/fjexq+VmtXzAlc63J4z5kFmWJ6NdAPQulQBT7g=') 
 *     be the same key originally used to encrypt the object. 
 */ 
 function download_encrypted_object(string $bucketName, string $objectName, string $destination, string $base64EncryptionKey): void 
 { 
 $storage = new StorageClient(); 
 $bucket = $storage->bucket($bucketName); 
 $object = $bucket->object($objectName); 
 $object->downloadToFile($destination, [ 
 'encryptionKey' => $base64EncryptionKey, 
 ]); 
 printf('Encrypted object gs://%s/%s downloaded to %s' . PHP_EOL, 
 $bucketName, $objectName, basename($destination)); 
 } 
 

  import 
  
 base64 
 from 
  
 google.cloud 
  
 import 
  storage 
 
 def 
  
 download_encrypted_blob 
 ( 
 bucket_name 
 , 
 source_blob_name 
 , 
 destination_file_name 
 , 
 base64_encryption_key 
 , 
 ): 
  
 """Downloads a previously-encrypted blob from Google Cloud Storage. 
 The encryption key provided must be the same key provided when uploading 
 the blob. 
 """ 
 # bucket_name = "your-bucket-name" 
 # source_blob_name = "storage-object-name" 
 # destination_file_name = "local/path/to/file" 
 # base64_encryption_key = "base64-encoded-encryption-key" 
 storage_client 
 = 
  storage 
 
 . 
  Client 
 
 () 
 bucket 
 = 
 storage_client 
 . 
  bucket 
 
 ( 
 bucket_name 
 ) 
 # Encryption key must be an AES256 key represented as a bytestring with 
 # 32 bytes. Since it's passed in as a base64 encoded string, it needs 
 # to be decoded. 
 encryption_key 
 = 
 base64 
 . 
 b64decode 
 ( 
 base64_encryption_key 
 ) 
 blob 
 = 
 bucket 
 . 
 blob 
 ( 
 source_blob_name 
 , 
 encryption_key 
 = 
 encryption_key 
 ) 
 blob 
 . 
  download_to_filename 
 
 ( 
 destination_file_name 
 ) 
 print 
 ( 
 f 
 "Blob 
 { 
 source_blob_name 
 } 
 downloaded to 
 { 
 destination_file_name 
 } 
 ." 
 ) 
 

  def 
  
 download_encrypted_file 
  
 bucket_name 
 :, 
  
 file_name 
 :, 
  
 local_file_path 
 :, 
  
 encryption_key 
 : 
  
 # The ID of your GCS bucket 
  
 # bucket_name = "your-unique-bucket-name" 
  
 # The ID of your GCS object 
  
 # file_name = "your-file-name" 
  
 # The path to which the file should be downloaded 
  
 # local_file_path = "/local/path/to/file.txt" 
  
 # The Base64 encoded decryption key, which should be the same key originally used to encrypt the object 
  
 # encryption_key = "TIbv/fjexq+VmtXzAlc63J4z5kFmWJ6NdAPQulQBT7g=" 
  
 require 
  
 "google/cloud/storage" 
  
 storage 
  
 = 
  
 Google 
 :: 
 Cloud 
 :: 
  Storage 
 
 . 
  new 
 
  
 bucket 
  
 = 
  
 storage 
 . 
 bucket 
  
 bucket_name 
 , 
  
 skip_lookup 
 : 
  
 true 
  
 file 
  
 = 
  
 bucket 
 . 
  file 
 
  
 file_name 
 , 
  
 encryption_key 
 : 
  
 encryption_key 
  
 file 
 . 
  download 
 
  
 local_file_path 
 , 
  
 encryption_key 
 : 
  
 encryption_key 
  
 puts 
  
 "Downloaded encrypted 
 #{ 
 file 
 . 
 name 
 } 
 to 
 #{ 
 local_file_path 
 } 
 " 
 end