Goodbye Service Account Keys, Hello Workload Identity Federation — Building Secure Apps with GCP

Tired of juggling a million service account keys for your cloud-based application? Want to up your security game without sacrificing the joy in your day? Look no further — Workload Identity Federation is here to save the day!

Service account keys can become a pain to manage when you have your application infrastructure spread across multiple cloud providers. They become a potential security risk for your application with additional management overhead for storage, rotation, and more.

This brings us to the world of workload identity federation on GCP, designed to solve that specific problem.

Today, I cover the following:

• What is workload identity federation (workload identity pools + IAM)?
• How to set it up on GCP.
• Live Example: How to use it up with a GitHub actions workflow.

Workload identity federation is simply Keyless authentication for service accounts. It solves the problems of storage of access keys, distribution, and rotation using short live dynamically provisioned tokens to authenticate your third-party applications to Google cloud platform.

More resources on workload identity federation:

• GCP documentation: https://cloud.google.com/iam/docs/workload-identity-federation
• GitHub Open ID connect setup: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-google-cloud-platform
• Google GitHub auth action: https://github.com/google-github-actions/auth
• Code samples repo used in this video: https://github.com/galonge/udemy-kustomize-mastery

To learn more about kubernetes configuration management with Kustomize, see here: https://www.udemy.com/course/kustomize-mastery-manage-kubernetes-configuration-with-ease/?referralCode=1AC82766C9CFBEB53544