{"repo":"Cyclenerd/google-workload-identity-federation","free":true,"listed":false,"github":"https://github.com/Cyclenerd/google-workload-identity-federation","clone":"git clone https://github.com/Cyclenerd/google-workload-identity-federation.git","description":"🔐 Google Cloud Workload Identity Federation Examples and How-To","language":null,"stars":12,"topics":["github-action","github-actions","google-cloud","google-cloud-platform","jwt","jwt-authentication","jwt-token","oidc","gitlab-ci","gitlab-runner"],"license":"Apache-2.0","category":"auth-billing-email","readme_excerpt":"Workload Identity Federation Service account keys are a security risk if compromised. Avoid service account keys and instead use the Workload Identity Federation. You can learn more about the best way to authenticate service accounts on Google Cloud in this repo. Unlike JSON service account keys, Workload Identity Federation generates short-lived OAuth 2.0 or JWT credentials. By default, these credentials automatically expire one hour after they are created, potentially reducing the time a malicious actor would be able to exploit a compromised credential. Because Workload Identity Federation uses short-lived credentials, there are no secrets to rotate or manage beyond the initial configuration. --- --- How-tos Warning Update 2024/04/04: GitHub and GitLab SaaS use a single issuer URL across all organizations and some of the claims embedded in OIDC tokens might not be unique to your organization. To help protect against spoofing threats, you must use an attribute condition that restricts access to tokens issued by your GitHub organization or GitLab group. This How-To has been updated to take this into account. Set up Identity Federation for: :octocat: GitHub Actions 🦊 GitLab CI 🪣 Bitbucket pipelines You can check the settings in Google Cloud Console. If you have understood the concept, you can also use my Terraform modules: Create Google Cloud Workload Identity for... GitHub GitLab Bitbucket Allow Login via WIF for Service Accounts This Terraform IaC makes the setup much fast","default_branch":null,"files":null,"tree":[],"storefront":"/r/Cyclenerd","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/Cyclenerd/google-workload-identity-federation/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}