AWX, Workload Identity Federation & GCP

Get Help
,
1

I’m looking for a solution to enable AWX to authenticate against GCP keylessly. I’ve seen implementations of such using GitHub Actions and Jenkins which use Workload Identity Federation. To the best of my understanding, a trust relationship is setup between a local entity that is able to impersonate a GCP service account and issue tokens on behalf of it that are valid in GCP. I don’t think such a feature exists in AWX. If it were, I suppose it would be based around a new credential type which would inject a GCP token into a job.

I could sort of do this using a GCP secrets engine in Hashicorp Vault to generate the token and a Hashicorp Vault Secret Lookup to read the generated token from Vault. However the GCP secret in Hashicorp Vault requires a GCP key and the Hashicorp Vault Secret Lookup in AWX requires a client ID and client secret. All of which is potentially vulnerable to exfiltration and needs to be regularly rotated.

2 Likes
2

Interesting. This has led me to begin reading about “Workload Identity Federation”. Do you agree that Service Account Key JSON" is not what you are looking for?

I’m going to try and read more about #1 and #2

edit:
Autenticar cargas de trabalho nas APIs do Google Cloud usando contas de serviço  |  Compute Engine Documentation If you are staying in GCP, I think this is all you need.