Workload Identity Federation Kms Least Privilege Audit

What this solution is

This architecture establishes a secure, keyless authentication bridge between external CI/CD pipeline runners and Google Cloud resources by combining Workload Identity Federation (WIF), fine-grained Cloud Key Management Service (Cloud KMS) access control, and comprehensive Cloud Audit Logging.

How it meets the requirements

• Eliminate long-lived keys: External runners exchange their short-lived OpenID Connect (OIDC) tokens for Google Cloud credentials using Workload Identity Federation instead of downloading exportable JSON service account keys.
• Least privilege access: Granting roles/cloudkms.cryptoKeyDecrypter strictly at the individual CryptoKey level (rather than across the entire KeyRing or project) ensures the service account can only decrypt payloads without having permissions to encrypt, destroy, or manage key configurations.
• Prevent identity spoofing: Mapping stable, immutable attributes (such as unique external issuer subject IDs or repository IDs) rather than mutable attributes (such as runner names or emails) prevents deleted or reassigned external identities from gaining unauthorized access.
• Non-repudiation: Enabling Data Access audit logs for both the Security Token Service (STS) API and the Identity and Access Management (IAM) API ensures all token exchange and service account impersonation events capture the external caller's subject in the audit trail.

Key advantages

• Limits the security blast radius to a single cryptographic key.
• Avoids key management overhead and rotation risks associated with static credentials.
• Ensures full traceability across the identity provider and Google Cloud audit logs.
• Enforces separation of duties between key administration and cryptographic operations.