A Terraform module to create and manage a Google Workload Identity Federation Pool in Google Cloud.

The pool allows Github Actions to authenticate with Google Cloud and to deploy to Google Cloud Run.

This repository has a .tools-versions file used by asdf to install the necessary tools. For this you need the following additional plugins:

asdf plugin add terraform-docs https://github.com/looztra/asdf-terraform-docs
asdf plugin add tflint https://github.com/skyzyx/asdf-tflint
asdf install

You can use the /repository sub-module to create a principal set for a specific repository. This is useful if you want to grant access to a specific repository.

See the repository/ README for more information.

module "github_federation" {
  source              = "github.com/helmless/google-workload-identity-federation-terraform-module?ref=v0.1.0"
  github_organization = "helmless"
}

The following input variables are required:

Description: The GitHub organization to bind to the workload identity pool and provider

Type: string

The following input variables are optional (have default values):

Description: The id of the workload identity pool and provider

Type: string

Default: "github"

The following outputs are exported:

Description: The principal set id for the GitHub organization to be used in IAM policies and bindings. Warning: this will grant all repositories in your Github organization the IAM role you bind this to. Use the repository_principal_set_id for more granular control.

Description: The name of the workload identity pool. Example: projects/1234567890/locations/global/workloadIdentityPools/github

Description: The name of the workload identity provider.

Description: The principal set id for the GitHub repository to be used in IAM policies and bindings. You must append the repository name to this id to use it.

The following requirements are needed by this module:

• terraform (>= 1.9.6, < 2)

• google (>= 5.0)

The following providers are used by this module:

• google (6.12.0)

No modules.

The following resources are used by this module:

• google_iam_workload_identity_pool.github (resource)
• google_iam_workload_identity_pool_provider.github (resource)