Workload Identity Federation Config Generator

Workload Identity Federation lets external workloads (running on AWS, Azure, GitHub Actions, Kubernetes, etc.) authenticate to Google Cloud APIs without needing a downloaded service account key file. Instead, your workload presents its native identity token (an AWS SigV4 request, an Azure managed identity JWT, a GitHub OIDC token, etc.) to GCP's Security Token Service, which exchanges it for a short-lived Google access token. This eliminates long-lived credential files that can be leaked or stolen.

Service account key files (JSON key files) are long-lived credentials that never expire unless you manually rotate them. If they are committed to git, logged, or copied to an insecure location they remain valid until deleted — a major security risk. WIF credentials are short-lived (1-hour tokens by default), tied to the specific identity of your workload, auditable in Cloud Audit Logs, and require zero file distribution. GCP, AWS, and GitHub all recommend WIF over static key files for CI/CD and cross-cloud access.

1. Enable the IAM and STS APIs in your GCP project. 2. Create a Workload Identity Pool: gcloud iam workload-identity-pools create POOL_ID --location=global --display-name='My Pool'. 3. Create a provider inside the pool, specifying the issuer URI and attribute mappings (e.g. for AWS: --provider-type=aws --account-id=AWS_ACCOUNT_ID). 4. Grant the external identity permission to impersonate a service account: gcloud iam service-accounts add-iam-policy-binding SA_EMAIL --role=roles/iam.workloadIdentityUser --member='principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/attribute.aws_role/arn:aws:sts::ACCOUNT:assumed-role/ROLE'. 5. Generate the credential configuration file using this tool and set GOOGLE_APPLICATION_CREDENTIALS to its path.

Yes. AWS-to-GCP is one of the most common WIF patterns. Your AWS workload (EC2, Lambda, EKS pod) fetches its IAM role credentials from IMDSv2, signs a GetCallerIdentity request using SigV4, and sends it to GCP STS. GCP verifies the AWS identity, checks your attribute mappings and IAM bindings, then returns a short-lived Google access token. The generated credential_configuration.json handles this entire flow automatically when loaded by any Google client library or the gcloud CLI.