Storage Transfer Service Workload Identity Azure

What Workload Identity Federation for Storage Transfer Service Is

Workload Identity Federation enables Google Cloud services and external workloads to securely exchange identity credentials without managing or storing static, long-lived API keys, client secrets, or private key JSON files. For Storage Transfer Service, Google Cloud uses its managed service agent identity to generate short-lived OpenID Connect (OIDC) ID tokens that external identity providers (such as Microsoft Entra ID / Azure AD) validate natively.

How It Meets the Security and Migration Requirements

• Eliminates Long-Lived Keys: No static Azure Storage access keys, SAS tokens, or downloadable Google Cloud service account keys are created or stored.
• Enforces Short-Lived Tokens: Granting the Service Account Token Creator (roles/iam.serviceAccountTokenCreator) role to the managed Storage Transfer Service service agent (service-PROJECT_NUMBER@gcp-sa-storagetransfer.iam.gserviceaccount.com) allows it to create ephemeral OIDC ID tokens on demand.
• Establishes Trust via Azure Federated Credentials: Registering an application in Azure and attaching a federated credential with Google's OIDC issuer URL and the service agent's unique subject ID allows Azure to authenticate incoming transfer requests securely.
• Follows Least Privilege: Permissions on Azure Blob Storage are granted directly to the registered Azure application identity, scoping access exclusively to the target source containers.

Key Advantages and Capabilities

• Zero Secret Sprawl: Eliminates operational overhead and security exposure associated with manual key rotation, secret leaking, and compromised long-lived credentials.
• Native Integration: Works directly with Storage Transfer Service transfer jobs without custom proxy infrastructure.
• Auditable Lifecycle: All token exchanges and access requests are logged within Cloud Audit Logs and Azure Activity/Sign-in logs.
• Standardized Multi-Cloud Architecture: Follows industry-standard OIDC federation patterns across heterogeneous cloud providers.

Why This Is Optimal

Federating the native Google Cloud service agent with Azure App Registration creates a completely keyless architecture. It satisfies the strict prohibition against static secrets while ensuring minimal administrative maintenance.