Enforce Keyless Org Policy Workload Identity Federation

What the solution is

This solution combines Google Cloud Organization Policy constraints with Workload Identity Federation and IAM service account impersonation to eliminate long-lived service account keys and transition external workloads to a keyless security architecture.

How it meets the requirements

• Preventing key creation and uploads: Enforcing the iam.disableServiceAccountKeyCreation constraint blocks the generation of downloadable service account private key pairs (.json or .p12). Enforcing iam.disableServiceAccountKeyUpload prevents principals from uploading their own external public keys to Google Cloud service accounts. Applying these at the organization root ensures hierarchical inheritance across all folders and projects.
• Enabling keyless external workload access: Workload Identity Federation allows workloads running on external clouds or on-premises systems to exchange their native identity provider tokens (such as OIDC or SAML 2.0 assertions) for federated Google Cloud credentials.
• Short-lived credential generation: Granting the external identity the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on a target service account allows it to impersonate that service account and generate short-lived OAuth 2.0 access tokens directly.

Key advantages

• Elimination of secret sprawl: Eliminates the risk of leaking static private keys in code repositories, configuration files, or build artifacts.
• Automated credential rotation: Short-lived access tokens expire automatically (typically within one hour), minimizing the window of vulnerability if intercepted.
• Centralized governance: Organization policies enforce preventative guardrails that cannot be overridden by individual project owners without explicit policy delegation.
• Standards-based federation: Uses industry-standard OIDC and SAML protocols to establish cryptographic trust between Google Cloud and external environments.

Why this is optimal

This approach directly targets the root risk of credential leakage by disabling user-managed key operations organization-wide while adopting Google Cloud's best-practice federated identity architecture for external workloads.