Update: Figured out how to curl Google Cloud Storage from a prod shell:
from google.appengine.api import app_identity
from google.appengine.api import urlfetch
token, expires = app_identity.get_access_token(['https://www.googleapis.com/auth/devstorage.read_only'])
x = urlfetch.fetch('https://storage.googleapis.com/...', headers={'Authorization': 'OAuth ' + token})
print x.content