Workload Identity Federation Audit And Security Controls

What this solution is

This strategy establishes an end-to-end security architecture for Workload Identity Federation (WIF) by combining deep audit logging with strict administrative boundaries and immutable claim mappings.

How it meets the audit trail requirement

• Security Token Service (STS) Data Access Logs: When an external workload exchanges an external token (such as an OIDC JWT or SAML assertion) for a federated token, the exchange is executed against the Security Token Service API (sts.googleapis.com). Enabling Data Access audit logs ensures that every token exchange event—along with its mapped external attributes—is permanently captured.
• IAM Data Access Logs: Impersonation events against service accounts via GenerateAccessToken are recorded in Identity and Access Management (IAM) API Data Access logs, providing an unbroken audit trail back to the originating external identity even when downstream resource APIs do not natively populate serviceAccountDelegationInfo.

How it meets the security and anti-spoofing requirement

• Dedicated Management Project: Managing workload identity pools in a dedicated project isolates the roles/iam.workloadIdentityPoolAdmin role, preventing unauthorized actors from inheriting iam.googleapis.com/workloadIdentityPoolProviders.update permissions from parent folders.
• Restricting Attribute Updates: Preventing unauthorized modifications to attribute mappings prevents attackers from altering mapping rules to grant themselves unauthorized service account access.
• Authoritative Claim Mapping: Mapping only immutable attributes (such as an internal unique user or repository ID) ensures that mutable attributes like usernames or email addresses cannot be spoofed in external systems.

Key advantages

• Non-repudiation: Complete correlation between external CI/CD workload executions and Google Cloud operations.
• Least privilege administration: Prevents privilege escalation through compromised provider configurations.
• Spoofing resistance: Eliminates risks associated with recycled or modified external usernames.