async function getTokenFromBroker(bucketName, objectPrefix) {
    const googleAuth = new GoogleAuth({
      scopes: 'https://www.googleapis.com/auth/cloud-platform',
    });

    // [START auth_downscoping_rules]
    // Define the Credential Access Boundary object.
    const cab = {
      // Define the access boundary.
      accessBoundary: {
        // Define the single access boundary rule.
        accessBoundaryRules: [
          {
            availableResource: `//storage.googleapis.com/projects/_/buckets/${bucketName}`,
            // Downscoped credentials will have readonly access to the resource.
            availablePermissions: ['inRole:roles/storage.objectViewer'],
            // Only objects starting with the specified prefix string in the object name
            // will be allowed read access.
            availabilityCondition: {
              expression:
                "resource.name.startsWith('projects/_/buckets/" +
                `${bucketName}/objects/${objectPrefix}')`,
            },
          },
        ],
      },
    };
    // [END auth_downscoping_rules]

    // [START auth_downscoping_initialize_downscoped_cred]
    // Obtain an authenticated client via ADC.
    const client = await googleAuth.getClient();

    // Use the client to create a DownscopedClient.
    const cabClient = new DownscopedClient(client, cab);

    // Refresh the tokens.
    const refreshedAccessToken = await cabClient.getAccessToken();
    // [END auth_downscoping_initialize_downscoped_cred]

    // This will need to be passed to the token consumer.
    return refreshedAccessToken;
  }
Simulates token broker generating downscoped tokens for specified bucket.

@param bucketName The name of the Cloud Storage bucket.
@param objectPrefix The prefix string of the object name. This is used
       to ensure access is restricted to only objects starting with this
       prefix string.