search

Cyclenerd / terraform-google-wif-service-account

🔐 Terraform module to allow login via Google Cloud Workload Identity Pool and Provider for service accounts
https://registry.terraform.io/modules/Cyclenerd/wif-service-account/google/latest
Apache License 2.0
2 stars 0 forks source link

Feature request: Allow `principal://` usage #4

Open KonStg opened 1 week ago

KonStg commented 1 week ago

The module currently does not support providing principals in the format: principal://iam.googleapis.com/${var.pool_name}/subject/${local.value}

Please add support for using not only principalSet://, but also principal://.
Additionally, there is a need to use more than two fixed attributes "attribute.sub" and "attribute.repository".

The lack of this capability required a lot of time to identify the problem with 403 . Issue with GutHub Actions

Cyclenerd commented 1 week ago

The module is intended to provide a simple option. If you want to do more customization and you are sure what you are doing, you can of course use the actual Terraform resource.

principalSet is listed for attribute values in the official documentation: https://cloud.google.com/iam/docs/workload-identity-federation#principal-types

And is also used by colleagues from Google Professional Services: https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/blob/master/fast/stages/0-bootstrap/identity-providers-defs.tf#L46

I personally also never had a problem with principalSet (like 403).