Is support available for GCP authentication via workload identity federation ?

[cahartma]

Is vector able to support type: "external_account", for GCP authentication? Workload identity federation allows service account impersonation via an external identity provider. It allows authentication using short-lived (sts) access tokens rather than long-lived "service_account" keys.
https://cloud.google.com/iam/docs/workload-identity-federation

WIF is basically the gcp equivalent of using aws (sts) 'role_arn' and 'web_identity_token' for authentication.

Thanks in advance.

[jszwedko]

@StephenWakely @bruceg just wondering if either of you have thoughts here since you've both worked with the GCP sinks.

[cahartma]

Hey @StephenWakely and/or @bruceg any info would be helpful. Is this on your radar currently or any thoughts about implementing?

[cahartma]

@jszwedko Do you have any idea if this is even on your radar yet? If not, it may be something we could attempt to contribute.

[neuronull]

👋 I've pinged Bruce and Stephen on this just this morning. Apologies for the delay~

[neuronull]

Hi @cahartma , we currently do not support this.
From a technical standpoint, it should be achievable (though we don't have a solid estimate on it without a little investigation).

As a starting point, we'd recommend opening a GH issue feature request with the proposed feature, to garnish community demand.
This will also raise it's visibility for contributors, which could lead to a PR adding support from the community.

[cahartma]

Thanks, done. #16387

[neuronull]

Thanks for the thorough report!