Log inSign upBook a demo
Tines Stories
  1. Docs
  2. Credentials
  3. Workload identity Federation
  1. Docs
  2. Credentials
  3. Workload identity Federation

Google Cloud

Last updated

Introduction

A Google Cloud credential authenticates to Google Cloud through workload identity federation. Tines signs a short-lived token for the credential and Google exchanges it for a short-lived access token, so no service account key is stored in Tines. The federated identity can impersonate a service account, or you can grant it roles directly.

You can create the credential with the Google Cloud connect flow, which walks you through the steps below, or manually by choosing Manual creation and the GCP credential type. Both show the same trust details.

Creating a Google Cloud credential

Step 1: Start the credential in Tines

From the credentials page, select New credential and choose Google Cloud, or choose Manual creation and then GCP. Tines shows the credential's Issuer URL and Subject. Keep this open while you work in Google Cloud.

Step 2: Create a workload identity pool and provider

  1. In the Google Cloud console, open IAM & Admin › Workload Identity Federation and select Create pool. Name the pool.

  2. Add a provider of type OpenID Connect (OIDC). For Issuer (URL), enter the credential's issuer URL. Skip the JWK file; Google fetches the keys from the issuer. Under Audiences, keep Default audience.

  3. Under Attribute mapping, map google.subject to assertion.sub, then create the provider.

Step 3: Grant this credential access

On the pool's page, select Grant access. To act as a service account, choose Grant access using service account impersonation, select the service account, and filter principals by the subject attribute with the credential's subject. To grant roles to the federated identity directly instead, use the pool principal for this subject and leave the service account blank in the next step.

Dismiss the "Configure your application" dialog Google offers afterwards; Tines does not use a credential file.

Step 4: Enter the provider details

In the connect flow, enter the Project number, Pool ID, and Provider ID, and optionally the Service account email to impersonate.

In the manual form, enter the Workload identity pool provider, which is the provider's full resource name: //iam.googleapis.com/projects/<project number>/locations/global/workloadIdentityPools/<pool ID>/providers/<provider ID>. Optionally enter the Service account to impersonate. Leave it blank if you granted roles to the federated identity directly.

Step 5: Save

Saving verifies the connection by exchanging a token with Google. IAM changes made just now can take a minute to take effect; if verification fails, wait briefly and save again.

Using a Google Cloud credential

The credential's value is a Google access token with the cloud-platform scope, renewed automatically. Use it as a bearer token in the Authorization header of an HTTP Request action:

"Authorization": "Bearer <<CREDENTIAL.google_cloud>>"

The access the token carries is whatever you granted in Google Cloud IAM, either to the service account Tines impersonates or directly to the pool principal for this credential's subject.

Test credentials

A test credential has its own subject, the live subject with a :test suffix, so grant it access separately, typically in a non-production project. See test credentials.

Was this helpful?