{"id":16164031,"url":"https://github.com/cyclenerd/google-workload-identity-federation","last_synced_at":"2025-09-17T11:13:20.093Z","repository":{"id":64962090,"uuid":"504911667","full_name":"Cyclenerd/google-workload-identity-federation","owner":"Cyclenerd","description":"🔐 Google Cloud Workload Identity Federation Examples and How-To","archived":false,"fork":false,"pushed_at":"2024-04-04T13:15:36.000Z","size":1767,"stargazers_count":12,"open_issues_count":2,"forks_count":2,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-08-10T23:46:49.715Z","etag":null,"topics":["gcp","github-action","github-actions","gitlab-ci","gitlab-runner","google-cloud","google-cloud-platform","jwt","jwt-authentication","jwt-token","oidc"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Cyclenerd.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-06-18T17:43:58.000Z","updated_at":"2025-04-21T15:01:27.000Z","dependencies_parsed_at":"2024-01-15T18:31:14.911Z","dependency_job_id":"3914a11b-b65e-42d8-a617-d3c182477533","html_url":"https://github.com/Cyclenerd/google-workload-identity-federation","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Cyclenerd/google-workload-identity-federation","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cyclenerd%2Fgoogle-workload-identity-federation","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cyclenerd%2Fgoogle-workload-identity-federation/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cyclenerd%2Fgoogle-workload-identity-federation/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cyclenerd%2Fgoogle-workload-identity-federation/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Cyclenerd","download_url":"https://codeload.github.com/Cyclenerd/google-workload-identity-federation/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cyclenerd%2Fgoogle-workload-identity-federation/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":275583445,"owners_count":25490667,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-17T02:00:09.119Z","response_time":84,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["gcp","github-action","github-actions","gitlab-ci","gitlab-runner","google-cloud","google-cloud-platform","jwt","jwt-authentication","jwt-token","oidc"],"created_at":"2024-10-10T02:45:00.530Z","updated_at":"2025-09-17T11:13:20.025Z","avatar_url":"https://github.com/Cyclenerd.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Workload Identity Federation\n\n[![Badge: Google Cloud](https://img.shields.io/badge/Google%20Cloud-%234285F4.svg?logo=google-cloud\u0026logoColor=white)](#readme)\n[![Badge: Terraform](https://img.shields.io/badge/Terraform-%235835CC.svg?logo=terraform\u0026logoColor=white)](https://github.com/Cyclenerd/google-workload-identity-federation/tree/master/allow/examples#readme)\n[![Badge: GitHub](https://img.shields.io/badge/GitHub-181717.svg?logo=github\u0026logoColor=white)](./github.md)\n[![Badge: GitLab](https://img.shields.io/badge/GitLab-FC6D26.svg?logo=gitlab\u0026logoColor=white)](./gitlab.md)\n[![Badge: Bitbucket](https://img.shields.io/badge/Bitbucket-0052CC.svg?logo=bitbucket\u0026logoColor=white)](./bitbucket.md)\n\nService account keys are a security risk if compromised.\nAvoid service account keys and instead use the [Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation).\nYou can learn more about the best way to authenticate service accounts on Google Cloud in this repo.\n\nUnlike JSON service account keys, Workload Identity Federation generates short-lived OAuth 2.0 or JWT credentials.\nBy default, these credentials automatically expire one hour after they are created,\npotentially reducing the time a malicious actor would be able to exploit a compromised credential.\n\nBecause Workload Identity Federation uses short-lived credentials, there are no secrets to rotate or manage beyond the initial configuration.\n\n---\n\n```mermaid\ngraph TD;\n  user(GitHub, GitLab etc...) --\u003e |1| token[GCP Security Token Services];\n  token \u003c--\u003e |2| pool[Workload Identity Pool]\n  user --\u003e |3| sa[Service Account];\n  sa --\u003e gcp[Google Cloud Platform Service]\n  user -.-\u003e pool\n  pool -.-\u003e sa\n```\n\n---\n\n\n## How-tos\n\n\u003e **Warning**\n\u003e Update 2024/04/04: GitHub and GitLab SaaS use a single issuer URL across all organizations and some of the claims embedded in OIDC tokens might not be unique to your organization.\n\u003e To help protect against spoofing threats, you must use an attribute condition that restricts access to tokens issued by your GitHub organization or GitLab group.\n\u003e This How-To has been updated to take this into account.\n\nSet up Identity Federation for:\n\n* :octocat: **[GitHub Actions](./github.md)**\n* 🦊 **[GitLab CI](./gitlab.md)**\n* 🪣 **[Bitbucket pipelines](./bitbucket.md)**\n\nYou can check the settings in [Google Cloud Console](./console.md).\n\nIf you have understood the concept, you can also use my Terraform modules:\n\n* Create Google Cloud Workload Identity for...\n  * [GitHub](https://registry.terraform.io/modules/Cyclenerd/wif-github/google/latest)\n  * [GitLab](https://registry.terraform.io/modules/Cyclenerd/wif-gitlab/google/latest)\n  * [Bitbucket](https://registry.terraform.io/modules/Cyclenerd/wif-bitbucket/google/latest)\n* [Allow Login via WIF for Service Accounts](https://registry.terraform.io/modules/Cyclenerd/wif-service-account/google/latest)\n\nThis Terraform IaC makes the setup much faster, easier, and less error prone.\n\n\n## Disable Service Account Keys\n\nYou can disabled the key creation for service accounts via the organization policy constraint: `constraints/iam.disableServiceAccountKeyCreation`\n\nThis organization policy constraint is not mandatory, but with it you can be sure that no one will create new service account keys and Workload Identity Federation will be used.\n\n\n## License\n\nAll files in this repository are under the [Apache License, Version 2.0](LICENSE) unless noted otherwise.\n\nPortions of this repository are modifications based on work created and shared by [Google](https://developers.google.com/readme/policies)\nand used according to terms described in the [Creative Commons 4.0 Attribution License](https://creativecommons.org/licenses/by/4.0/).\n\nPlease note:\n\n* No warranty\n* No official Google product\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcyclenerd%2Fgoogle-workload-identity-federation","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcyclenerd%2Fgoogle-workload-identity-federation","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcyclenerd%2Fgoogle-workload-identity-federation/lists"}