Workforce Pool Iam Role Session Duration

What Workforce Identity Pool Principal Sets and Session Durations Are

Workforce Identity Federation allows users managed in an external IdP (such as Microsoft Entra ID or Okta) to access Google Cloud resources directly without synchronizing user accounts into Cloud Identity. Group-based access is granted by referencing the mapped google.groups attribute using a specific principalSet:// resource identifier format under the organization-scoped workforce identity pool. The session duration setting manages the credential lifecycle and controls how long federated sessions and security tokens remain valid.

How It Meets the Requirements

• Group role binding: To grant access to an entire IdP group mapped to google.groups, IAM requires the principalSet:// prefix targeting the workforce pool resource path followed by /group/GROUP_ID. Specifically, principalSet://iam.googleapis.com/locations/global/workforcePools/corp-analysts-pool/group/sec-analysts ensures all analysts within that group inherit roles/storage.objectViewer on analytics-prod.
• Session lifecycle management: Configuring --session-duration=14400s (4 hours) at the workforce identity pool level directly governs the maximum lifetime of issued Google Cloud access tokens, federated web console sign-in sessions, and gcloud CLI sessions. Google Cloud supports workforce pool session durations between 15 minutes (900s) and 12 hours (43200s), making 14,400 seconds valid.

Key Advantages and Capabilities

• Syncless group governance: Allows administrators to manage team membership dynamically in the upstream identity provider without provisioning Google Accounts.
• Unified credential lifecycle: Enforces uniform session expiration across both graphical user interface (console) and programmatic (gcloud CLI) access pathways.
• Organization-level scoping: Workforce pools are globally identified at the organization level (locations/global/workforcePools/), avoiding hardcoded project numbers in member identifiers.
• Least privilege: Session limits minimize the exposure window if a federated token or workstation session is compromised.

Why This Is Optimal

This approach uses the exact workforce pool principal identifier syntax and leverages the native --session-duration parameter on the workforce pool resource to enforce access boundaries and credential lifecycles cleanly.