thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Cloud Computing · Advanced

Workload Identity Federation

Google Cloud feature letting external workloads (AWS, Azure, OIDC/SAML, CI/CD) access Google Cloud without service account keys.

Definition

Workload Identity Federation uses workload identity pools and providers to exchange external credentials, such as AWS roles, Azure managed identities or GitHub Actions OIDC tokens, for short-lived Google Cloud access tokens, optionally impersonating a service account. It eliminates long-lived key files.

Example

A GitHub Actions workflow deploys to Cloud Run using an OIDC token exchanged through a workload identity pool.

Exam tip

Whenever a scenario involves external workloads and service account keys, the secure answer is Workload Identity Federation.

Related terms