---
title: "Connect Service Account to Workload Identity Pool"
slug: "service-account-to-wipool-wif"
updated: 2026-07-27T11:23:04Z
published: 2026-07-27T11:23:04Z
canonical: "docs.britive.com/service-account-to-wipool-wif"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.britive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Service Account to Workload Identity Pool

## For Organization-level Access

1. Log in to the [GCP Console](https://console.cloud.google.com) using administrative privileges.
2. From the selector on the top, select organization. (You must be on the root organisation level.)
3. Select **IAM & Admin** -> **IAM** from the navigation menu.
4. Go to **View By Roles** and click **Grant Access.**
5. Provide the newly created service account email in the **New principals** text box.
6. In the **Assign Roles,** select the custom role.
7. Click **Save**.
8. From GCP CLI run the below command:

```shell
gcloud iam service-accounts add-iam-policy-binding <SERVICE_ACCOUNT_EMAIL> --role="roles/iam.serviceAccountTokenCreator" --member="principalSet://iam.googleapis.com/projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/<WORKLOAD_IDENTITY_POOL_ID>/*"
```

## For Limited (Folder/Project) Access

1. Log in to the [GCP Console](https://console.cloud.google.com) using administrative privileges.
2. Select **IAM & Admin** -> **Manage Resources** from the navigation menu.
3. Select the folder/project to which you want to grant access, and on the right-hand side in the info panel in the Permissions tab, click on **Add Principal**.
4. Provide the newly created service account email in the **New principals** text box.
5. In the **Assign Roles**, select the custom role.
6. Click **Save**.
7. From GCP CLI run the below command:

```shell
gcloud iam service-accounts add-iam-policy-binding <SERVICE_ACCOUNT_EMAIL> --role="roles/iam.serviceAccountTokenCreator" --member="principalSet://iam.googleapis.com/projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/<WORKLOAD_IDENTITY_POOL_ID>/*"
```