feat: workload identity federation support (#686)
Using workload identity federation, applications can access Google Cloud resources from Amazon Web Services (AWS), Microsoft Azure or any identity provider that supports OpenID Connect (OIDC). Workload identity federation is recommended for non-Google Cloud environments as it avoids the need to download, manage and store service account private keys locally.
diff --git a/google/auth/impersonated_credentials.py b/google/auth/impersonated_credentials.py
index 4d15837..b8a6c49 100644
--- a/google/auth/impersonated_credentials.py
+++ b/google/auth/impersonated_credentials.py
@@ -65,7 +65,9 @@
_DEFAULT_TOKEN_URI = "https://oauth2.googleapis.com/token"
-def _make_iam_token_request(request, principal, headers, body):
+def _make_iam_token_request(
+ request, principal, headers, body, iam_endpoint_override=None
+):
"""Makes a request to the Google Cloud IAM service for an access token.
Args:
request (Request): The Request object to use.
@@ -73,6 +75,9 @@
headers (Mapping[str, str]): Map of headers to transmit.
body (Mapping[str, str]): JSON Payload body for the iamcredentials
API call.
+ iam_endpoint_override (Optiona[str]): The full IAM endpoint override
+ with the target_principal embedded. This is useful when supporting
+ impersonation with regional endpoints.
Raises:
google.auth.exceptions.TransportError: Raised if there is an underlying
@@ -82,7 +87,7 @@
`iamcredentials.googleapis.com` is not enabled or the
`Service Account Token Creator` is not assigned
"""
- iam_endpoint = _IAM_ENDPOINT.format(principal)
+ iam_endpoint = iam_endpoint_override or _IAM_ENDPOINT.format(principal)
body = json.dumps(body).encode("utf-8")
@@ -185,6 +190,7 @@
delegates=None,
lifetime=_DEFAULT_TOKEN_LIFETIME_SECS,
quota_project_id=None,
+ iam_endpoint_override=None,
):
"""
Args:
@@ -209,6 +215,9 @@
quota_project_id (Optional[str]): The project ID used for quota and billing.
This project may be different from the project used to
create the credentials.
+ iam_endpoint_override (Optiona[str]): The full IAM endpoint override
+ with the target_principal embedded. This is useful when supporting
+ impersonation with regional endpoints.
"""
super(Credentials, self).__init__()
@@ -226,6 +235,7 @@
self.token = None
self.expiry = _helpers.utcnow()
self._quota_project_id = quota_project_id
+ self._iam_endpoint_override = iam_endpoint_override
@_helpers.copy_docstring(credentials.Credentials)
def refresh(self, request):
@@ -260,6 +270,7 @@
principal=self._target_principal,
headers=headers,
body=body,
+ iam_endpoint_override=self._iam_endpoint_override,
)
def sign_bytes(self, message):
@@ -302,6 +313,7 @@
delegates=self._delegates,
lifetime=self._lifetime,
quota_project_id=quota_project_id,
+ iam_endpoint_override=self._iam_endpoint_override,
)