Keyless Access Scoped to Callers You Meant

gcp-workload-identity-federation

Keyless access from outside Google, scoped to the callers you actually meant. Works with Terraform and OpenTofu (>= 1.6), google provider >= 6.0, < 7.0.

attribute_condition is optional, and omitting it is the worst default in this service. The issuer is not yours. For GitHub Actions the issuer is GitHub's, so "any token this issuer signs" means any workflow, in any repository, belonging to anybody, anywhere on GitHub - all of it able to impersonate whatever service account the pool grants. The setup works perfectly in testing, because your workflow is one of the ones it admits, and that is exactly why this one gets shipped. A precondition refuses a provider with no condition, and a second refuses a GitHub provider whose condition never mentions the repository or its owner, since a condition that only checks how a token was issued has not narrowed who.

The member string is the other half. A binding to principalSet://…/attribute.repository/my-org/my-repo is one repository; principalSet://…/* is everything the pool admits. Those differ by very little in a place nobody reads twice, so a precondition refuses the wildcard and wildcard_grants is an output that should stay empty.

This exists to replace service account keys, which is the point. A downloaded key is a credential with no expiry that lives in somebody's CI settings forever and survives every offboarding. A federated token lasts an hour and cannot be lifted out of the workflow that earned it - provided the condition above is real.

Pin assertion.sub where you can. GitHub's subject claim already carries the repository and the ref in one value (repo:org/repo:ref:refs/heads/main), so there is no way to satisfy half of it. Separate assertion.repository and assertion.ref clauses are equivalent and more flexible; repository_owner alone is the weakest form still worth having, because it admits every repository in your organisation including one a contractor opened this morning.

Smaller things: google.subject must be mapped and Google's error does not say which key is missing, so a precondition names it; and a pool id cannot be reused for 30 days after deletion, so it is worth picking a name you can live with.

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.