An organization wants to configure Workload Identity Federation to allow an on-premises application to access Google Cloud resources without using long-lived service account keys. In what sequence should the administrator perform the configuration steps?
- 1Create a Workload Identity Pool and Workload Identity Provider in Google Cloud to establish trust with the external identity provider.
- 2Create a dedicated Google Cloud service account assigned with the minimal required IAM permissions.
- 3Assign the Workload Identity User role (roles/iam.workloadIdentityUser) to the external workload identity on the target service account.
- 4Configure the external application to exchange its local identity token for a short-lived Google Cloud service account access token.
Answer
The correct sequence begins by establishing trust via the Workload Identity Pool and Provider, followed by provisioning the target Google Cloud service account with minimal IAM permissions. Next, grant the external workload identity permission to impersonate the service account using the Workload Identity User role, and finally configure the application to execute dynamic short-lived token exchange.
The proper administrative order follows standard identity federation setup: establish trust infrastructure first (Pool/Provider), create the destination GCP service account with least privilege permissions second, attach the impersonation binding (`roles/iam.workloadIdentityUser`) third, and lastly update application code to perform short-lived token exchanges.
Step-by-Step Solution
Key Concept
Workload Identity Federation lifecycle configuration steps