Workload Identity Federation Ephemeral Tokens

What Workload Identity Federation is

Workload Identity Federation is a Google Cloud IAM capability that enables workloads running outside Google Cloud (such as in AWS, Microsoft Azure, GitHub Actions, or on-premises environments) to impersonate service accounts or directly access Google Cloud resources by exchanging external identity tokens for short-lived, ephemeral Google Cloud access tokens.

How it meets the requirements

• Eliminating long-lived service account keys: Workloads do not require downloadable .json service account keys stored on external infrastructure. Trust is established cryptographically via identity federation.
• Ephemeral token exchange: The external workload requests a native identity token (such as an AWS STS signed request or an Azure Microsoft Entra ID OIDC token) and sends it to the Google Cloud Security Token Service (STS), which validates the token against the Workload Identity Provider and returns a temporary OAuth 2.0 access token.
• Granular attribute mapping: Workload Identity Federation maps claims from external tokens (such as AWS ARN, Azure Tenant ID, or custom claims) to Google Cloud attributes (such as google.subject, google.groups, or attribute.custom_name), allowing access to be bound directly to specific principalSet:// strings in IAM allow policies.

Key advantages

• Zero credential storage: Eliminates key lifecycle overhead, rotation scripts, and exposure vectors.
• Direct resource access: Supports direct resource-level role grants using principal:// and principalSet:// without requiring service account impersonation.
• Least privilege enforcement: Supports Attribute Conditions using Common Expression Language (CEL) to filter which external identities can authenticate.

Why this is optimal

This approach aligns with Google Cloud security best practices by eliminating static secrets while preserving fine-grained authorization across hybrid and multi-cloud architectures.