Ctrlk
ProductSupportOpen Zenlytic
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Google Workload Identity Federation

Use workload identity federation to connect BigQuery without storing long-lived service account keys.

These are the steps a customer needs to take to enable Workload Identity Federation (WIF) to let Zenlytic (hosted in AWS) connect their BigQuery instance (hosted in GCP).

  1. Enable the required APIs: Security Token Service (STS), IAM Service Account Credentials, and BigQuery APIs

  2. Create a Workload Identity Pool. You can create this via the console, following these instructions. First, navigate to Workload identity federation and begin the process to create a workload identity pool

google_workload_identity_federation_image_1.png

After clicking Get Started, fill out the next screen

google_workload_identity_federation_image_2.png

  1. Next, create the provider and add it to the Pool. Select AWS, and use the Zenlytic AWS account id 734818345323

google_workload_identity_federation_image_3.png

  1. Configure the following two attribute mappings, then click Save at the bottom of the screen.

Attribute
Mapping expression

google.subject

assertion.arn.extract('assumed-role/{role}/')

attribute.aws_role

assertion.arn.extract('assumed-role/{role}/')

Important: google.subject appears grayed out in the screenshot below as a placeholder — you must explicitly fill it in with the expression above. Do not leave it empty or set it to assertion.arn.

GCP enforces a 127-byte limit on google.subject. Setting it to assertion.arn (the full role ARN including the session UUID) can exceed this limit. Using assertion.arn.extract('assumed-role/{role}/') maps only the role name (~46 bytes), well within the limit.

google_workload_identity_federation_image_4.png

  1. Get the principle value to add permissions to in GCP. You will need to follow the format in these Google Cloud Workload Identity Federation documentation from Google, which will be:

You will fill in those values with the values you have from this process so far, and one value from the Zenlytic team.

  • <PROJECT_NUMBER> is the project number of your GCP project. (e.g. 123456789)

  • <POOL_ID> is the id of the pool you've created (note the light grey text in step 2, for this example the value is zenlytic-aws-federation-pool)

  • <ATTRIBUTE_VALUE> you will confirm this with your Zenlytic account contact, but the value will follow a pattern like this, which corresponds to the special purpose AWS role Zenlytic will use to call out to your resources (e.g. <company_name>-gcp-wif-prod). We recommend keeping this name short to stay well within GCP's 127-byte limit for google.subject.

Using those values, the final principle would be

  1. Give that principle access to the resources in BigQuery you would like it to have. For example, in the IAM screen, click "Grant Access"

google_workload_identity_federation_image_5.png

Then paste the full url of the principle that you defined earlier in the principle option and hit enter. After you do that, you can give the principle the required roles for BigQuery.

Finally, click Save.

  1. Download the config for the principle to connect. In the Workload Identity Pool, click Grant Access to get started

google_workload_identity_federation_image_7.png

Then leave the first option checked, and click Download config

google_workload_identity_federation_image_8.png

Select the Zenlytic AWS zenlytic-aws provider, and click Download config

google_workload_identity_federation_image_9.png

You will put this config into Zenlytic to configure the connection to BigQuery, after adding the project_id to the json.

  1. Finally, the json will look like

PreviousOkta Zenlytic
NextEnforce SSO-Only Login

Last updated

Was this helpful?