private_key = open('/path/to/your-key.p12', 'rb').read()
pkcs12 = crypto.load_pkcs12(private_key, 'notasecret')
pem = crypto.dump_privatekey(crypto.FILETYPE_PEM, pkcs12.get_privatekey())
pem_key = RSA.importKey(pem)
signer = PKCS1_v1_5.new(pem_key)
signature_hash = SHA256.new(signature_string)
signature_bytes = signer.sign(signature_hash)
signature = base64.b64encode(signature_bytes)
query_params = {'GoogleAccessId': 'your-service-account@googleapis.com',
    'Expires': str(expiration), 'Signature': signature}
return '{endpoint}{resource}?{querystring}'.format(endpoint=self.
    API_ACCESS_ENDPOINT, resource=resource, querystring=urllib.parse.urlencode(
    query_params))
Google Cloud Storage Signed URLs with Google App Engine