google-cloud-storage 2.18.2__tar.gz → 2.19.0__tar.gz

{google_cloud_storage-2.18.2/google_cloud_storage.egg-info → google_cloud_storage-2.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: google-cloud-storage
-Version: 2.18.2
+Version: 2.19.0
 Summary: Google Cloud Storage API client library
 Home-page: https://github.com/googleapis/python-storage
 Author: Google LLC

{google_cloud_storage-2.18.2 → google_cloud_storage-2.19.0}/google/cloud/storage/_helpers.py

@@ -293,6 +293,9 @@ class _PropertyMixin(object):
         )
         if soft_deleted is not None:
             query_params["softDeleted"] = soft_deleted
+            # Soft delete reload requires a generation, even for targets
+            # that don't include them in default query params (buckets).
+            query_params["generation"] = self.generation
         headers = self._encryption_headers()
         _add_etag_match_headers(
             headers, if_etag_match=if_etag_match, if_etag_not_match=if_etag_not_match

{google_cloud_storage-2.18.2 → google_cloud_storage-2.19.0}/google/cloud/storage/_opentelemetry_tracing.py

@@ -54,6 +54,12 @@ _default_attributes = {
     "user_agent.original": f"gcloud-python/{__version__}",
 }
 
+_cloud_trace_adoption_attrs = {
+    "gcp.client.service": "storage",
+    "gcp.client.version": __version__,
+    "gcp.client.repo": "googleapis/python-storage",
+}
+
 
 @contextmanager
 def create_trace_span(name, attributes=None, client=None, api_request=None, retry=None):
@@ -79,6 +85,7 @@ def create_trace_span(name, attributes=None, client=None, api_request=None, retr
 
 def _get_final_attributes(attributes=None, client=None, api_request=None, retry=None):
     collected_attr = _default_attributes.copy()
+    collected_attr.update(_cloud_trace_adoption_attrs)
     if api_request:
         collected_attr.update(_set_api_request_attr(api_request, client))
     if isinstance(retry, api_retry.Retry):

{google_cloud_storage-2.18.2 → google_cloud_storage-2.19.0}/google/cloud/storage/_signing.py

@@ -28,8 +28,10 @@ import google.auth.credentials
 from google.auth import exceptions
 from google.auth.transport import requests
 from google.cloud import _helpers
+from google.cloud.storage._helpers import _DEFAULT_UNIVERSE_DOMAIN
 from google.cloud.storage._helpers import _NOW
 from google.cloud.storage._helpers import _UTC
+from google.cloud.storage.retry import DEFAULT_RETRY
 
 
 # `google.cloud.storage._signing.NOW` is deprecated.
@@ -271,6 +273,7 @@ def generate_signed_url_v2(
     query_parameters=None,
     service_account_email=None,
     access_token=None,
+    universe_domain=None,
 ):
     """Generate a V2 signed URL to provide query-string auth'n to a resource.
 
@@ -384,7 +387,9 @@ def generate_signed_url_v2(
     # See https://github.com/googleapis/google-cloud-python/issues/922
     # Set the right query parameters.
     if access_token and service_account_email:
-        signature = _sign_message(string_to_sign, access_token, service_account_email)
+        signature = _sign_message(
+            string_to_sign, access_token, service_account_email, universe_domain
+        )
         signed_query_params = {
             "GoogleAccessId": service_account_email,
             "Expires": expiration_stamp,
@@ -432,6 +437,7 @@ def generate_signed_url_v4(
     query_parameters=None,
     service_account_email=None,
     access_token=None,
+    universe_domain=None,
     _request_timestamp=None,  # for testing only
 ):
     """Generate a V4 signed URL to provide query-string auth'n to a resource.
@@ -623,7 +629,9 @@ def generate_signed_url_v4(
     string_to_sign = "\n".join(string_elements)
 
     if access_token and service_account_email:
-        signature = _sign_message(string_to_sign, access_token, service_account_email)
+        signature = _sign_message(
+            string_to_sign, access_token, service_account_email, universe_domain
+        )
         signature_bytes = base64.b64decode(signature)
         signature = binascii.hexlify(signature_bytes).decode("ascii")
     else:
@@ -647,7 +655,12 @@ def get_v4_now_dtstamps():
     return timestamp, datestamp
 
 
-def _sign_message(message, access_token, service_account_email):
+def _sign_message(
+    message,
+    access_token,
+    service_account_email,
+    universe_domain=_DEFAULT_UNIVERSE_DOMAIN,
+):
     """Signs a message.
 
     :type message: str
@@ -669,17 +682,22 @@ def _sign_message(message, access_token, service_account_email):
     message = _helpers._to_bytes(message)
 
     method = "POST"
-    url = "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{}:signBlob?alt=json".format(
-        service_account_email
-    )
+    url = f"https://iamcredentials.{universe_domain}/v1/projects/-/serviceAccounts/{service_account_email}:signBlob?alt=json"
     headers = {
         "Authorization": "Bearer " + access_token,
         "Content-type": "application/json",
     }
     body = json.dumps({"payload": base64.b64encode(message).decode("utf-8")})
-
     request = requests.Request()
-    response = request(url=url, method=method, body=body, headers=headers)
+
+    def retriable_request():
+        response = request(url=url, method=method, body=body, headers=headers)
+        return response
+
+    # Apply the default retry object to the signBlob call.
+    retry = DEFAULT_RETRY
+    call = retry(retriable_request)
+    response = call()
 
     if response.status != http.client.OK:
         raise exceptions.TransportError(

{google_cloud_storage-2.18.2 → google_cloud_storage-2.19.0}/google/cloud/storage/blob.py

@@ -607,6 +607,9 @@ class Blob(_PropertyMixin):
             client = self._require_client(client)  # May be redundant, but that's ok.
             credentials = client._credentials
 
+        client = self._require_client(client)
+        universe_domain = client.universe_domain
+
         if version == "v2":
             helper = generate_signed_url_v2
         else:
@@ -638,6 +641,7 @@ class Blob(_PropertyMixin):
             query_parameters=query_parameters,
             service_account_email=service_account_email,
             access_token=access_token,
+            universe_domain=universe_domain,
         )
 
     @create_trace_span(name="Storage.Blob.exists")
@@ -2344,7 +2348,6 @@ class Blob(_PropertyMixin):
             "upload.checksum": f"{checksum}",
         }
         args = {"timeout": timeout}
-        # import pdb; pdb.set_trace()
         with create_trace_span(
             name="Storage.ResumableUpload/transmitNextChunk",
             attributes=extra_attributes,

{google_cloud_storage-2.18.2 → google_cloud_storage-2.19.0}/google/cloud/storage/bucket.py

@@ -626,6 +626,10 @@ class Bucket(_PropertyMixin):
     :type user_project: str
     :param user_project: (Optional) the project ID to be billed for API
                          requests made via this instance.
+
+    :type generation: int
+    :param generation: (Optional) If present, selects a specific revision of
+                       this bucket.
     """
 
     _MAX_OBJECTS_FOR_ITERATION = 256
@@ -659,7 +663,7 @@ class Bucket(_PropertyMixin):
     )
     """Allowed values for :attr:`location_type`."""
 
-    def __init__(self, client, name=None, user_project=None):
+    def __init__(self, client, name=None, user_project=None, generation=None):
         """
         property :attr:`name`
             Get the bucket's name.
@@ -672,6 +676,9 @@ class Bucket(_PropertyMixin):
         self._label_removals = set()
         self._user_project = user_project
 
+        if generation is not None:
+            self._properties["generation"] = generation
+
     def __repr__(self):
         return f"<Bucket: {self.name}>"
 
@@ -726,6 +733,50 @@ class Bucket(_PropertyMixin):
         """
         return self._user_project
 
+    @property
+    def generation(self):
+        """Retrieve the generation for the bucket.
+
+        :rtype: int or ``NoneType``
+        :returns: The generation of the bucket or ``None`` if the bucket's
+                  resource has not been loaded from the server.
+        """
+        generation = self._properties.get("generation")
+        if generation is not None:
+            return int(generation)
+
+    @property
+    def soft_delete_time(self):
+        """If this bucket has been soft-deleted, returns the time at which it became soft-deleted.
+
+        :rtype: :class:`datetime.datetime` or ``NoneType``
+        :returns:
+            (readonly) The time that the bucket became soft-deleted.
+             Note this property is only set for soft-deleted buckets.
+        """
+        soft_delete_time = self._properties.get("softDeleteTime")
+        if soft_delete_time is not None:
+            return _rfc3339_nanos_to_datetime(soft_delete_time)
+
+    @property
+    def hard_delete_time(self):
+        """If this bucket has been soft-deleted, returns the time at which it will be permanently deleted.
+
+        :rtype: :class:`datetime.datetime` or ``NoneType``
+        :returns:
+            (readonly) The time that the bucket will be permanently deleted.
+            Note this property is only set for soft-deleted buckets.
+        """
+        hard_delete_time = self._properties.get("hardDeleteTime")
+        if hard_delete_time is not None:
+            return _rfc3339_nanos_to_datetime(hard_delete_time)
+
+    @property
+    def _query_params(self):
+        """Default query parameters."""
+        params = super()._query_params
+        return params
+
     @classmethod
     def from_string(cls, uri, client=None):
         """Get a constructor for bucket object by URI.
@@ -1045,6 +1096,7 @@ class Bucket(_PropertyMixin):
         if_metageneration_match=None,
         if_metageneration_not_match=None,
         retry=DEFAULT_RETRY,
+        soft_deleted=None,
     ):
         """Reload properties from Cloud Storage.
 
@@ -1084,6 +1136,13 @@ class Bucket(_PropertyMixin):
         :type retry: google.api_core.retry.Retry or google.cloud.storage.retry.ConditionalRetryPolicy
         :param retry:
             (Optional) How to retry the RPC. See: :ref:`configuring_retries`
+
+        :type soft_deleted: bool
+        :param soft_deleted: (Optional) If True, looks for a soft-deleted
+            bucket. Will only return the bucket metadata if the bucket exists
+            and is in a soft-deleted state. The bucket ``generation`` must be
+            set if ``soft_deleted`` is set to True.
+            See: https://cloud.google.com/storage/docs/soft-delete
         """
         super(Bucket, self).reload(
             client=client,
@@ -1094,6 +1153,7 @@ class Bucket(_PropertyMixin):
             if_metageneration_match=if_metageneration_match,
             if_metageneration_not_match=if_metageneration_not_match,
             retry=retry,
+            soft_deleted=soft_deleted,
         )
 
     @create_trace_span(name="Storage.Bucket.patch")
@@ -2159,8 +2219,8 @@ class Bucket(_PropertyMixin):
         :param client: (Optional) The client to use. If not passed, falls back
                        to the ``client`` stored on the current bucket.
 
-        :type generation: long
-        :param generation: (Optional) If present, selects a specific revision of this object.
+        :type generation: int
+        :param generation: Selects the specific revision of the object.
 
         :type copy_source_acl: bool
         :param copy_source_acl: (Optional) If true, copy the soft-deleted object's access controls.

{google_cloud_storage-2.18.2 → google_cloud_storage-2.19.0}/google/cloud/storage/client.py

@@ -30,6 +30,7 @@ from google.cloud._helpers import _LocalStack
 from google.cloud.client import ClientWithProject
 from google.cloud.exceptions import NotFound
 
+from google.cloud.storage._helpers import _add_generation_match_parameters
 from google.cloud.storage._helpers import _bucket_bound_hostname_url
 from google.cloud.storage._helpers import _get_api_endpoint_override
 from google.cloud.storage._helpers import _get_environ_project
@@ -367,7 +368,7 @@ class Client(ClientWithProject):
         api_response = self._get_resource(path, timeout=timeout, retry=retry)
         return api_response["email_address"]
 
-    def bucket(self, bucket_name, user_project=None):
+    def bucket(self, bucket_name, user_project=None, generation=None):
         """Factory constructor for bucket object.
 
         .. note::
@@ -381,10 +382,19 @@ class Client(ClientWithProject):
         :param user_project: (Optional) The project ID to be billed for API
                              requests made via the bucket.
 
+        :type generation: int
+        :param generation: (Optional) If present, selects a specific revision of
+                           this bucket.
+
         :rtype: :class:`google.cloud.storage.bucket.Bucket`
         :returns: The bucket object created.
         """
-        return Bucket(client=self, name=bucket_name, user_project=user_project)
+        return Bucket(
+            client=self,
+            name=bucket_name,
+            user_project=user_project,
+            generation=generation,
+        )
 
     def batch(self, raise_exception=True):
         """Factory constructor for batch object.
@@ -789,7 +799,7 @@ class Client(ClientWithProject):
             _target_object=_target_object,
         )
 
-    def _bucket_arg_to_bucket(self, bucket_or_name):
+    def _bucket_arg_to_bucket(self, bucket_or_name, generation=None):
         """Helper to return given bucket or create new by name.
 
         Args:
@@ -798,17 +808,27 @@ class Client(ClientWithProject):
                  str, \
             ]):
                 The bucket resource to pass or name to create.
+            generation (Optional[int]):
+                The bucket generation. If generation is specified,
+                bucket_or_name must be a name (str).
 
         Returns:
             google.cloud.storage.bucket.Bucket
                 The newly created bucket or the given one.
         """
         if isinstance(bucket_or_name, Bucket):
+            if generation:
+                raise ValueError(
+                    "The generation can only be specified if a "
+                    "name is used to specify a bucket, not a Bucket object. "
+                    "Create a new Bucket object with the correct generation "
+                    "instead."
+                )
             bucket = bucket_or_name
             if bucket.client is None:
                 bucket._client = self
         else:
-            bucket = Bucket(self, name=bucket_or_name)
+            bucket = Bucket(self, name=bucket_or_name, generation=generation)
         return bucket
 
     @create_trace_span(name="Storage.Client.getBucket")
@@ -819,6 +839,9 @@ class Client(ClientWithProject):
         if_metageneration_match=None,
         if_metageneration_not_match=None,
         retry=DEFAULT_RETRY,
+        *,
+        generation=None,
+        soft_deleted=None,
     ):
         """Retrieve a bucket via a GET request.
 
@@ -837,12 +860,12 @@ class Client(ClientWithProject):
                 Can also be passed as a tuple (connect_timeout, read_timeout).
                 See :meth:`requests.Session.request` documentation for details.
 
-            if_metageneration_match (Optional[long]):
+            if_metageneration_match (Optional[int]):
                 Make the operation conditional on whether the
-                blob's current metageneration matches the given value.
+                bucket's current metageneration matches the given value.
 
-            if_metageneration_not_match (Optional[long]):
-                Make the operation conditional on whether the blob's
+            if_metageneration_not_match (Optional[int]):
+                Make the operation conditional on whether the bucket's
                 current metageneration does not match the given value.
 
             retry (Optional[Union[google.api_core.retry.Retry, google.cloud.storage.retry.ConditionalRetryPolicy]]):
@@ -859,6 +882,19 @@ class Client(ClientWithProject):
                 See the retry.py source code and docstrings in this package (google.cloud.storage.retry) for
                 information on retry types and how to configure them.
 
+            generation (Optional[int]):
+                The generation of the bucket. The generation can be used to
+                specify a specific soft-deleted version of the bucket, in
+                conjunction with the ``soft_deleted`` argument below. If
+                ``soft_deleted`` is not True, the generation is unused.
+
+            soft_deleted (Optional[bool]):
+                If True, looks for a soft-deleted bucket. Will only return
+                the bucket metadata if the bucket exists and is in a
+                soft-deleted state. The bucket ``generation`` is required if
+                ``soft_deleted`` is set to True.
+                See: https://cloud.google.com/storage/docs/soft-delete
+
         Returns:
             google.cloud.storage.bucket.Bucket
                 The bucket matching the name provided.
@@ -867,13 +903,14 @@ class Client(ClientWithProject):
             google.cloud.exceptions.NotFound
                 If the bucket is not found.
         """
-        bucket = self._bucket_arg_to_bucket(bucket_or_name)
+        bucket = self._bucket_arg_to_bucket(bucket_or_name, generation=generation)
         bucket.reload(
             client=self,
             timeout=timeout,
             if_metageneration_match=if_metageneration_match,
             if_metageneration_not_match=if_metageneration_not_match,
             retry=retry,
+            soft_deleted=soft_deleted,
         )
         return bucket
 
@@ -1386,6 +1423,8 @@ class Client(ClientWithProject):
         page_size=None,
         timeout=_DEFAULT_TIMEOUT,
         retry=DEFAULT_RETRY,
+        *,
+        soft_deleted=None,
     ):
         """Get all buckets in the project associated to the client.
 
@@ -1438,6 +1477,12 @@ class Client(ClientWithProject):
         :param retry:
             (Optional) How to retry the RPC. See: :ref:`configuring_retries`
 
+        :type soft_deleted: bool
+        :param soft_deleted:
+            (Optional) If true, only soft-deleted buckets will be listed as distinct results in order of increasing
+            generation number. This parameter can only be used successfully if the bucket has a soft delete policy.
+            See: https://cloud.google.com/storage/docs/soft-delete
+
         :rtype: :class:`~google.api_core.page_iterator.Iterator`
         :raises ValueError: if both ``project`` is ``None`` and the client's
                             project is also ``None``.
@@ -1469,6 +1514,9 @@ class Client(ClientWithProject):
         if fields is not None:
             extra_params["fields"] = fields
 
+        if soft_deleted is not None:
+            extra_params["softDeleted"] = soft_deleted
+
         return self._list_resource(
             "/b",
             _item_to_bucket,
@@ -1480,6 +1528,71 @@ class Client(ClientWithProject):
             retry=retry,
         )
 
+    def restore_bucket(
+        self,
+        bucket_name,
+        generation,
+        projection="noAcl",
+        if_metageneration_match=None,
+        if_metageneration_not_match=None,
+        timeout=_DEFAULT_TIMEOUT,
+        retry=DEFAULT_RETRY,
+    ):
+        """Restores a soft-deleted bucket.
+
+        :type bucket_name: str
+        :param bucket_name: The name of the bucket to be restored.
+
+        :type generation: int
+        :param generation: Selects the specific revision of the bucket.
+
+        :type projection: str
+        :param projection:
+            (Optional) Specifies the set of properties to return. If used, must
+            be 'full' or 'noAcl'. Defaults to 'noAcl'.
+
+        if_metageneration_match (Optional[int]):
+            Make the operation conditional on whether the
+            blob's current metageneration matches the given value.
+
+        if_metageneration_not_match (Optional[int]):
+            Make the operation conditional on whether the blob's
+            current metageneration does not match the given value.
+
+        :type timeout: float or tuple
+        :param timeout:
+            (Optional) The amount of time, in seconds, to wait
+            for the server response.  See: :ref:`configuring_timeouts`
+
+        :type retry: google.api_core.retry.Retry or google.cloud.storage.retry.ConditionalRetryPolicy
+        :param retry:
+            (Optional) How to retry the RPC.
+
+            Users can configure non-default retry behavior. A ``None`` value will
+            disable retries. See [Configuring Retries](https://cloud.google.com/python/docs/reference/storage/latest/retry_timeout).
+
+        :rtype: :class:`google.cloud.storage.bucket.Bucket`
+        :returns: The restored Bucket.
+        """
+        query_params = {"generation": generation, "projection": projection}
+
+        _add_generation_match_parameters(
+            query_params,
+            if_metageneration_match=if_metageneration_match,
+            if_metageneration_not_match=if_metageneration_not_match,
+        )
+
+        bucket = self.bucket(bucket_name)
+        api_response = self._post_resource(
+            f"{bucket.path}/restore",
+            None,
+            query_params=query_params,
+            timeout=timeout,
+            retry=retry,
+        )
+        bucket._set_properties(api_response)
+        return bucket
+
     @create_trace_span(name="Storage.Client.createHmacKey")
     def create_hmac_key(
         self,
@@ -1724,13 +1837,16 @@ class Client(ClientWithProject):
             )
 
         credentials = self._credentials if credentials is None else credentials
-        ensure_signed_credentials(credentials)
+        client_email = service_account_email
+        if not access_token or not service_account_email:
+            ensure_signed_credentials(credentials)
+            client_email = credentials.signer_email
 
         # prepare policy conditions and fields
         timestamp, datestamp = get_v4_now_dtstamps()
 
         x_goog_credential = "{email}/{datestamp}/auto/storage/goog4_request".format(
-            email=credentials.signer_email, datestamp=datestamp
+            email=client_email, datestamp=datestamp
         )
         required_conditions = [
             {"bucket": bucket_name},

{google_cloud_storage-2.18.2 → google_cloud_storage-2.19.0}/google/cloud/storage/transfer_manager.py

@@ -885,6 +885,8 @@ def download_chunks_concurrently(
             "'checksum' is in download_kwargs, but is not supported because sliced downloads have a different checksum mechanism from regular downloads. Use the 'crc32c_checksum' argument on download_chunks_concurrently instead."
         )
 
+    download_kwargs = download_kwargs.copy()
+    download_kwargs["checksum"] = None
     download_kwargs["command"] = "tm.download_sharded"
 
     # We must know the size and the generation of the blob.

{google_cloud_storage-2.18.2 → google_cloud_storage-2.19.0}/google/cloud/storage/version.py

@@ -12,4 +12,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-__version__ = "2.18.2"
+__version__ = "2.19.0"

{google_cloud_storage-2.18.2 → google_cloud_storage-2.19.0/google_cloud_storage.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: google-cloud-storage
-Version: 2.18.2
+Version: 2.19.0
 Summary: Google Cloud Storage API client library
 Home-page: https://github.com/googleapis/python-storage
 Author: Google LLC

{google_cloud_storage-2.18.2 → google_cloud_storage-2.19.0}/tests/system/_helpers.py

@@ -31,6 +31,10 @@ retry_failures = RetryErrors(AssertionError)
 
 user_project = os.environ.get("GOOGLE_CLOUD_TESTS_USER_PROJECT")
 testing_mtls = os.getenv("GOOGLE_API_USE_CLIENT_CERTIFICATE") == "true"
+test_universe_domain = os.getenv("TEST_UNIVERSE_DOMAIN")
+test_universe_project_id = os.getenv("TEST_UNIVERSE_PROJECT_ID")
+test_universe_location = os.getenv("TEST_UNIVERSE_LOCATION")
+test_universe_domain_credential = os.getenv("TEST_UNIVERSE_DOMAIN_CREDENTIAL")
 signing_blob_content = b"This time for sure, Rocky!"
 is_api_endpoint_override = (
     _get_default_storage_base_url() != "https://storage.googleapis.com"

{google_cloud_storage-2.18.2 → google_cloud_storage-2.19.0}/tests/system/conftest.py

@@ -331,3 +331,86 @@ def keyring(storage_client, kms_bucket, kms_client):
         except exceptions.NotFound:
             key = {"purpose": purpose}
             kms_client.create_crypto_key(keyring_path, key_name, key)
+
+
+@pytest.fixture(scope="function")
+def test_universe_domain():
+    if _helpers.test_universe_domain is None:
+        pytest.skip("TEST_UNIVERSE_DOMAIN not set in environment.")
+    return _helpers.test_universe_domain
+
+
+@pytest.fixture(scope="function")
+def test_universe_project_id():
+    if _helpers.test_universe_project_id is None:
+        pytest.skip("TEST_UNIVERSE_PROJECT_ID not set in environment.")
+    return _helpers.test_universe_project_id
+
+
+@pytest.fixture(scope="function")
+def test_universe_location():
+    if _helpers.test_universe_location is None:
+        pytest.skip("TEST_UNIVERSE_LOCATION not set in environment.")
+    return _helpers.test_universe_location
+
+
+@pytest.fixture(scope="function")
+def test_universe_domain_credential():
+    if _helpers.test_universe_domain_credential is None:
+        pytest.skip("TEST_UNIVERSE_DOMAIN_CREDENTIAL not set in environment.")
+    return _helpers.test_universe_domain_credential
+
+
+@pytest.fixture(scope="function")
+def universe_domain_credential(test_universe_domain_credential):
+    from google.oauth2 import service_account
+
+    return service_account.Credentials.from_service_account_file(
+        test_universe_domain_credential
+    )
+
+
+@pytest.fixture(scope="function")
+def universe_domain_client(
+    test_universe_domain, test_universe_project_id, universe_domain_credential
+):
+    from google.cloud.storage import Client
+
+    client_options = {"universe_domain": test_universe_domain}
+    ud_storage_client = Client(
+        project=test_universe_project_id,
+        credentials=universe_domain_credential,
+        client_options=client_options,
+    )
+    with contextlib.closing(ud_storage_client):
+        yield ud_storage_client
+
+
+@pytest.fixture(scope="function")
+def universe_domain_bucket(universe_domain_client, test_universe_location):
+    bucket_name = _helpers.unique_name("gcp-systest-ud")
+    bucket = universe_domain_client.create_bucket(
+        bucket_name, location=test_universe_location
+    )
+
+    blob = bucket.blob("README.txt")
+    blob.upload_from_string(_helpers.signing_blob_content)
+
+    yield bucket
+
+    _helpers.delete_bucket(bucket)
+
+
+@pytest.fixture(scope="function")
+def universe_domain_iam_client(
+    test_universe_domain, test_universe_project_id, universe_domain_credential
+):
+    from google.cloud import iam_credentials_v1
+
+    client_options = {"universe_domain": test_universe_domain}
+    iam_client = iam_credentials_v1.IAMCredentialsClient(
+        credentials=universe_domain_credential,
+        client_options=client_options,
+    )
+
+    return iam_client