Skip to content

GCP Workload Identity Federation (Automated)

Overview

The Terraform configuration creates and configures the service account, assigns required organization-level roles, and establishes a secure federation link between your AWS role and Google Cloud service account for SailPoint Entro onboarding.

Terraform Onboarding

This onboarding method automates Workload Identity Federation (WIF) configuration using Terraform.

15KB
SailPoint Entro GCP Terraform onboarding.zip
archive
Download Open

In the provided files above, use following file **tf-var-files/wif-setup.tfvars** and fill in the required fields.

Where to find the SailPoint Entro ARN: In the SailPoint Entro portal, go to Management → Accounts & Integrations → Add New Account → Google Cloud Platform, then select Workload Identity Federation as the auth method. The ARN is displayed on that screen.

The ARN format is:

arn:aws:sts::937217723901:assumed-role/EntroTrustRole-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Set this to false if you want to limit API enablement to the host project only (recommended if you don't have org-wide permissions).

enable_services_on_all_projects = false

organization_domain  = "Your orgnization Domain"
project              = "Your selected onboarding project ID"
region               = "us-central1"
zone                 = "us-central1-a"
service_account_name = "Choose a name for your service account"
aws_sts_arn          = "Entro Arn"
aws_account_id       = "937217723901"

Running the Terraform

  1. Prepare the project

    For this onboarding, select an existing project to create the service account in, or create a new one.

    Once selected, enable Cloud Resource Manager API for Terraform to be able to operate within this project. Similarly, enable the IAM API for the onboarding project.

  2. Configure the onboarding project as your local project for gcloud cli

    run gcloud auth login --update-adc --project=<onboarding-project-name>

  3. Initialize Terraform

    terraform init

  4. Plan with Variables

    terraform plan -var-file tf-var-files/wif-setup.tfvars

  5. Apply with Variables

    terraform apply -var-file tf-var-files/wif-setup.tfvars

Output

After successful execution, Terraform outputs the onboarding JSON configuration. Copy this JSON and use it directly in SailPoint Entro’s GCP integration onboarding form including the brackets.

    {
      "universe_domain": "googleapis.com",
      "type": "external_account",
      "audience": "//iam.googleapis.com/projects/2756056728/locations/global/workloadIdentityPools/entro-idp-id-589/providers/entro-wip-id-589",
      "subject_token_type": "urn:ietf:params:aws:token-type:aws4_request",
      "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/entro-serviceaccount-wif-setup@gen-lang-client-0568456307.iam.gserviceaccount.com:generateAccessToken",
      "token_url": "https://sts.googleapis.com/v1/token",
      "credential_source": {
        "environment_id": "aws1",
        "region_url": "http://192.168.120.222/latest/meta-data/placement/availability-zone",
        "url": "http://194.237.299.211/latest/meta-data/iam/security-credentials",
        "regional_cred_verification_url": "https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15"
      }
}