What are GCP Workload Identity Federation and AWS IAM Roles for Service Accounts (IRSA)?

GCP Workload Identity Federation lets workloads obtain short‑lived Google Cloud tokens without storing service‑account keys, while AWS IAM Roles for Service Accounts (IRSA) lets Kubernetes pods assume IAM roles via the pod’s service account, eliminating static AWS credentials. **Implementation steps** **GCP Workload Identity Federation** 1. `gcloud iam workload-identity-pools create my-pool --location=global`. 2. Create a provider (e.g., OIDC from Azure AD): ```bash gcloud iam workload-identity-pools providers create-oidc my-provider \ --workload-identity-pool=my-pool \ --location=global \ --issuer-uri=https://login.microsoftonline.com//v2.0 \ --attribute-mapping="google.subject=assertion.sub,attribute.aws_role=assertion.role" ``` 3. Grant the GCP service account permission to impersonate: ```bash gcloud iam service-accounts add-iam-policy-binding \ my-gcp-sa@my-project.iam.gserviceaccount.com \ --member="principalSet://iam.googleapis.com/projects//locations/global/workloadIdentityPools/my-pool/*" \ --role="roles/iam.workloadIdentityUser" ``` 4. In the workload, exchange the external token for a GCP access token via `https://sts.googleapis.com/v1/token`. **AWS IRSA** 1. Create an IAM role with a trust policy referencing the Kubernetes service account: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": {"Federated": "arn:aws:iam:::oidc-provider/oidc.eks..amazonaws.com/id/"}, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": {"StringEquals": {"oidc.eks..amazonaws.com/id/:sub": "system:serviceaccount:my-namespace:my-sa"}} } ] } ``` 2. Annotate the Kubernetes service account: ```yaml apiVersion: v1 kind: ServiceAccount metadata: name: my-sa namespace: my-namespace annotations: eks.amazonaws.com/role-arn: arn:aws:iam:::role/MyIRSArole ``` 3. Pods using this SA automatically receive temporary AWS credentials via the EKS metadata server. **Quick comparison** | Feature | GCP Workload Identity Federation | AWS IRSA | |---------|----------------------------------|----------| | Credential type | Short‑lived GCP access token | Temporary AWS STS credentials | | Identity source | Any OIDC/SAML provider | EKS OIDC provider | | Token exchange endpoint | `sts.googleapis.com` | EKS metadata server (`/service-accounts` endpoint) | | Auditable binding | IAM Policy on workload‑identity pool | IAM Role trust policy + service‑account annotation | **Gotcha**: Both systems rely on the external identity provider’s clock; a drift >5 minutes will cause token validation failures, so synchronize NTP on all workload nodes.