Connect Service Account to Workload Identity Pool

Prev Next

  1. Log in to the GCP Console using administrative privileges.

  2. From the selector on the top, select organization. (You must be on the root organisation level.)

  3. Select IAM & Admin -> IAM from the navigation menu.

  4. Go to View By Roles and click Grant Access.

  5. Provide the newly created service account email in the New principals text box.

  6. In the Assign Roles, select the custom role.

  7. Click Save.

  8. From GCP CLI run the below command:

gcloud iam service-accounts add-iam-policy-binding <SERVICE_ACCOUNT_EMAIL> --role="roles/iam.serviceAccountTokenCreator" --member="principalSet://iam.googleapis.com/projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/<WORKLOAD_IDENTITY_POOL_ID>/*"